If one calls PDDocument#getLastSignatureDictionary, the AcroFrom is populated with the defaults even if not needed. This modifies the internals of the PDDocument and therefore there are changes to be saved, even if the file is not modified by "real" changes.
This calls the verifyOrCreateDefaults() method, which initializes the DR-Dictionary if not yet done. This is even done if getLastSignatureDictionary returns null.
Why this bothers me: it is very unexpected behaviour that a getter modifies an objects state. This is no big deal for our usecase, the other issue (
PDFBOX-4303) was a bigger problem as we are diffing objects between revisions (current vs last signed revision).