External Signing

When the private key never leaves a KMS, an HSM or a signing service, UniPDF computes the digest and something else produces the signature. There are two ways to wire that up. A signature handler that calls the service from inside appender.Write works when the service answers within the call, which is how the AWS KMS, Google Cloud KMS, GlobalSign and PKCS11 guides do it. When the signature arrives later, or from another system, Sign with an external service shows how to write the file once with a blank signature, send the bytes to be signed away and patch the result into the same file.

The examples are in signatures/external. Its README has the setup for AWS KMS, Google Cloud KMS, GlobalSign DSS and the SoftHSM token the PKCS11 example needs.