When inserting a certificate into an invoice automatically, you lock the data (invalidating the certificate if a single byte is changed) and add metadata (such as date & time or name of the user) which will provide proof of authenticity.