Signs a PDF in the browser with a real detached CMS signature (SHA-256 with RSA, adbe.pkcs7.detached) covering the whole file except the placeholder that holds it, plus a visible signature block on the page you choose. Supply your certificate and PKCS#8 private key as PEM — they never leave the browser and nothing here stores them — or let the tool generate a self-signed pair, which proves the file has not changed since signing but says nothing about who signed it. Encrypted files must be unlocked first.