Currently I try to understand signing and validating in Ethereum and Solidity. For this I have found the following tutorial: https://medium.com/@angellopozo/ethereum-signing-and-validating-13a2d7cb0ee3. What I don't understand is who can call eth_sign via JSON RPC? In my application the geth node will provide the JSON RPC but then everyone, also people who are not the owner of of the account, can sign their messages and afterwards verify this message as far as I understand.
The problem I need so solve is that in my application I want to sign data with a private key and in my Smart Contract I need to verify this data with a public key. How can I solve this issue when everyone can call eth_sign?