Signature based on public key cryptography and forgery In the definition of existential unforgeability, there is no detail about the following questions.
In general, can we suppose that a signer is also a possible adversary? When generating a signature, can we suppose that the signer behaves well?
More precisely, suppose that a signer can generate a signature that is valid for another document of his choice. Despite this, for a correctly generated signature, suppose that the signature scheme used is secure when considering an adversary who is not the signer; that is to say, this adversary cannot generate a signature for any other document. Is this signature scheme considered secure?
What is the standard (conventional) hypothesis about that?
I update in reaction to the comment:
In fact,

If the signer behaves well, then the signature is unforgeable (for the signer or any adversary who is not the signer).

If the signer misbehaves, then the signature is forgeable (for the signer, without using the key, and for any adversary).


Is this kind of scheme considered secure in the sense of existential forgeability? Can we suppose that the signer behaves well?
The standard definition of existential forgery allows the adversary to ask and obtain the signature of any message she wants, and claim success if she can exhibit (with sizable odds) any acceptable (message, signature) pair, for any message for which she did not ask signature.

Update: There is also strong existential unforgeability, where the adversary should not be able to exhibit any acceptable (message, signature) pair for which she did not obtain that signature by asking for the signature of that message. For a use case making the headlines where that strong makes a huge difference, see these links.

Note: in a signature scheme with message recovery, any fraction of the message embedded in the signature needs not be exhibited by the adversary, and is as obtained by the verifier for the purpose of comparison to what the adversary submitted.

Corrected: If "a signer is able to generate a signature which is valid for an other document (that is, message) of his choice", then that scheme is vulnerable to existential forgery. The adversary obtains the signature of the first message, submits that signature unchanged together with the second message, and wins with 100% odds the existential forgery game. Oh no, only the signer could do this, using access to the private key!

Existential forgery is the strongest a strong theoretical criteria for signature. However, it assumes that the signer does not misbehave beside allowing the signature of arbitrary messages; in particular, it is assumed that the signer (or the Smart Card used for signature) does not leak the private key only uses the private key as prescribed, and properly implements every step in the algorithm, like generating truly random numbers.

Update: This spot-on comment by Ricky Demer gives names of security criteria for signatures protected from some attacks by the signer / private key holder.

Update: as pointed by DrLecter in a comment, the standard way to model the signer for a scheme secure against existential forgery (we also say: secure under chosen message attack) is as an oracle that accepts any message and outputs its signature. That oracle is assumed to implement the signature scheme exactly as specified. For more details, I refer to DrLecter's thesaurus of signature security models.