[GH-ISSUE #1860] Trusted Signatures Support #538

New issue

Open

opened 2026-02-26 18:47:29 +03:00 by kerem · 0 comments

kerem commented

2026-02-26 18:47:29 +03:00

Owner

Originally created by @koehn on GitHub (Jun 26, 2025).
Original GitHub issue: https://github.com/documenso/documenso/issues/1860

Feature Description

Trusted signatures can perform HSM-backed PDF signing with AATL and eIDAS compliant certificates. This would allow Documenso administrators to use that service instead of managing their own Google Cloud-based certificates.

Use Case

Trusted Signatures (https://trusted-signatures.com) is a new service that signs PDFs. Given an API Key ID and API Key, the service uses a key/certificate stored in an HSM to sign PDFs. Test certificates are available for free, or for as little as $0.001 per PDF sign them with a certificate that is AATL and eIDAS compliant.

This would offer an alternative to using the Google Cloud HSM or self-signed p12 certificates, eliminating the need for building your own certificate, HSM, and infrastructure.

Proposed Solution

This can be implemented as an alternative to the current 'local' and 'gcloud-hsm' transports. Trusted Signatures has a documented API that, given the SHA-256 digest of a PDF returns a CMS ready to be inserted into a placeholder in that PDF. The API is authenticated via an API Key ID and an HMAC-SHA256 digest.

By implementing this as a transport, administrators have the option to quickly and easily sign their users' PDFs.

Alternatives (optional)

No response

Additional Context

I founded Trusted Signatures to solve this specific problem.

Please check the boxes that apply to this feature request.

I have searched the existing feature requests to make sure this is not a duplicate.
I have provided a detailed description of the requested feature.
I have explained the use case or scenario for this feature.
I have included any relevant technical details or design suggestions.
I understand that this is a suggestion and that there is no guarantee of implementation.
I want to work on creating a PR for this issue if approved

Originally created by @koehn on GitHub (Jun 26, 2025). Original GitHub issue: https://github.com/documenso/documenso/issues/1860 ### Feature Description Trusted signatures can perform HSM-backed PDF signing with AATL and eIDAS compliant certificates. This would allow Documenso administrators to use that service instead of managing their own Google Cloud-based certificates. ### Use Case Trusted Signatures (https://trusted-signatures.com) is a new service that signs PDFs. Given an API Key ID and API Key, the service uses a key/certificate stored in an HSM to sign PDFs. Test certificates are available for free, or for as little as $0.001 per PDF sign them with a certificate that is AATL and eIDAS compliant. This would offer an alternative to using the Google Cloud HSM or self-signed p12 certificates, eliminating the need for building your own certificate, HSM, and infrastructure. ### Proposed Solution This can be implemented as an alternative to the current 'local' and 'gcloud-hsm' transports. Trusted Signatures has a [documented API](https://trusted-signatures.com/docs/api) that, given the SHA-256 digest of a PDF returns a CMS ready to be inserted into a placeholder in that PDF. The API is authenticated via an API Key ID and an HMAC-SHA256 digest. By implementing this as a transport, administrators have the option to quickly and easily sign their users' PDFs. ### Alternatives (optional) _No response_ ### Additional Context I founded Trusted Signatures to solve this specific problem. ### Please check the boxes that apply to this feature request. - [x] I have searched the existing feature requests to make sure this is not a duplicate. - [x] I have provided a detailed description of the requested feature. - [x] I have explained the use case or scenario for this feature. - [x] I have included any relevant technical details or design suggestions. - [x] I understand that this is a suggestion and that there is no guarantee of implementation. - [x] I want to work on creating a PR for this issue if approved