This aims at solving problems like: make a secure RSA public/private ker pair, of which you know the private key, such that this m enrypts to that c under textbook RSA. It is broken, well known, or klugreuter-fgrieu?
As a consequence: verifying a signature of a file against Alice's RSA public key is proof neither that the file is unchanged since signature, nor that Alice was the signer.
As in "exists x forall y" versus "forall y exists x"? Or is order a reference to time arrow? If Alice's key is certified, the date in this should be after the signature, which in an ideal world should raise alarm.
Constructive use: the signature of a file is on a trusted site. The file is not. Alice may alter the file, and manages to get her public key in the verifier's keystore (with the key identifier of the legitimate signer, if there is such thing in the signature).
The verifier, who uses crypto as a magic tool, sees that the signature verifies, and trusts the secure site to hold trusted signatures of trusted files. There is a chance than the file's alteration (if any) goes uncaught, or/and that the file is misattributed to Alice.
