In the case of sensitive pdfs, it's enough to check you network is not inexplicably in use, and I explain how to do a network audit in the notebook (yay literate programming). BTW this is "sign" as in overlay an image of your physical signature, not certify with a digital signature.
That’s what most want when they think of signing a document. There’s all sorts of technical stuff relative to PDF Signing (cryptographic) and why it matters but most people that want signed documents want to be able to say the user was presented with this document and signed it. Most also fail to understand the technical mechanisms that are important to be able to defend that a user saw what you wanted them to see and then signed it. It’d be easy to argue that the other party showed you another document, got your signature and then overlaid it onto a new document. That’s the issue with many open source signing schemes, they aren’t provable because few if any implement both cryptographic signing and signature overlay.
have there been any legal cases where the overlay was not sufficient?
What if there is an iframe in the page, then I don't think you will see anything in network logs in devtools...