Reorder, rotate, delete and merge pages, then sign it. All on your own device.
Your signature is the one genuinely sensitive thing this site touches, so here is exactly what remembering it does. The picture is encrypted on this device with a key worked out from your PIN, and the PIN itself is never written down anywhere. What sits in browser storage is a block of ciphertext: opening it without the PIN gets nothing, and altering it makes it refuse to open at all. The honest limit is that a short PIN is a short PIN, so use six or more characters, letters as well as numbers if you can. Leave the box unticked and nothing is kept once you close the tab.
This always writes a new file. Nothing you opened is altered, and the name is yours to change before it is written.