RemoteSigner (com.pd4ml 4.1.1 API Documentation)

```
public interface RemoteSigner
```
The cloud-KMS signing seam: implement this against whichever key management service holds your signing key -- AWS KMS, Azure Key Vault, GCP Cloud KMS, a corporate signing service, anything reachable over the network -- and hand the result to CertificateUtils.forRemoteKey(java.security.cert.Certificate[], com.pd4ml.pdf.sign.RemoteSigner).
pdfsign-api deliberately bundles no vendor SDK: KMS client libraries are large, versioned independently of this project, and typically need account/region/credential configuration only the caller can provide. Implementing this one method is normally a thin wrapper around a single SDK call, for example (AWS KMS, pseudocode):
```
 RemoteSigner awsKmsSigner = (dataToSign, jcaSignatureAlgorithm) -> {
     SignRequest request = new SignRequest()
             .withKeyId(keyId)
             .withMessage(ByteBuffer.wrap(digest(dataToSign, jcaSignatureAlgorithm)))
             .withMessageType(MessageType.DIGEST)
             .withSigningAlgorithm(mapToKmsAlgorithm(jcaSignatureAlgorithm));
     return kmsClient.sign(request).getSignature().array();
 };
 
```
Whether the KMS API wants the raw message or a pre-hashed digest, and how its own signing-algorithm enum maps to the JCA name this method receives, is vendor-specific -- consult that KMS's API docs.

Method Summary

All Methods Instance Methods Abstract Methods
Modifier and Type	Method	Description
`byte[]`	`sign(byte[] dataToSign, java.lang.String jcaSignatureAlgorithm)`	Produces a raw signature over `dataToSign`, valid under `jcaSignatureAlgorithm` (e.g.

- Method Detail
  - sign
```
byte[] sign(byte[] dataToSign,
            java.lang.String jcaSignatureAlgorithm)
     throws java.lang.Exception
```
    Produces a raw signature over dataToSign, valid under jcaSignatureAlgorithm (e.g. "SHA256withRSA" or "SHA256withECDSA" -- never a "...withNONE" or "raw" variant; this library never sends a pre-computed hash to this method, since the KMS's own digest/padding conventions vary by vendor and it is simplest for the implementation to control that itself). The returned bytes must be in the same encoding a Signature configured with that algorithm would produce (e.g. DER-encoded ASN.1 Ecdsa-Sig-Value for an EC algorithm, or a raw PKCS#1 v1.5 signature for an RSA algorithm) -- exactly what the equivalent KMS "sign" API call is expected to return.
    
    Parameters:
    
    dataToSign - the exact bytes to sign
    
    jcaSignatureAlgorithm - the JCA algorithm name the result must be valid under
    
    Returns:
    
    the raw signature bytes
    
    Throws:
    
    java.lang.Exception - any failure talking to the KMS; wrapped as a PdfSigningException by the caller