The attacks seem a little complicated... by the sound of it, more complicated than those needed to edit a Scottish vaccination certificate (not sure if those were PDFs, as they are [sensibly] rather coy about the details, but I'm not surprised by any of it).