Sign a PDF cryptographically with a digital certificate. Unlike a drawn signature, this binds the document to your key: a reader can verify who signed it and can tell whether so much as a byte has changed since. This is the form of signature expected for legally significant documents, tender submissions and anything that must be demonstrably unaltered.
From a certificate authority if the signature needs to be trusted by others automatically, or many countries issue them on national ID cards. A self-signed certificate works technically but will show as untrusted until the recipient explicitly trusts it.
PKCS#12 bundles (.p12 or .pfx), PEM certificate and key files, and Java keystores. PKCS#12 is the most common export format from browsers and operating system key stores.
Untrusted normally means the signing certificate does not chain to an authority the reader trusts, which is expected for self-signed certificates. Invalid means the document changed after signing - even adding a page number afterwards will break the signature.
Not without invalidating the signature. Detecting exactly that is the point of it. Do all your edits first and sign last.
Files are uploaded over an encrypted connection and processed on CoonTool's own server, not in your browser. The working copy is deleted automatically once the job is done, and in any case within 24 hours. Nothing is stored permanently and no account is required.