Edited signed PDFs can pass pdfsig validation, so ByteRange must be checked against file size

A developer found that pdfsig reported a signed PDF as valid after a one-line edit appended to the file, while pyHanko flagged the same change as an illegal modification. The discrepancy arises because pdfsig only verifies the hash of the originally signed bytes, which remained unchanged. To detect post-signing changes, the author wrote a check comparing each signature's ByteRange end offset with the file size, which distinguishes full coverage, appended updates, and rewritten files. Rewritten copies from several PDF tools, including a compressor, showed ranges extending past the end of the file. The author notes that a heuristic based on file size alone may fail for rewrites that grow the file, and suggests counting %%EOF markers as a possible fix.