If a foundry asks you to send them the font (the actual .otf file) before you have signed a contract with them, how can you be sure that they won't just outright steal it from you and claim they did it? You did all of (or at least most) the work for them already, after all. What if they ask for the FontLab file? I'm kind of leery about handing that over to someone, even if they are supposed to be reputable, before they've signed anything.

It doesn't have to be a contract, but is there some kind of document that I can ask them to sign first, that will protect me?