Also a simple tool to check signatures, if they are valid etc.

BTW pdfsig from the poppler tools is mentioned in the list of tools.

Okular has recently gotten improved support for verifying cryptographic signatures in PDF files.

https://tsdgeos.blogspot.com/2022/03/okular-signature-suppor...

Verifying digital signatures is quite hard. Yeah, checking whether the stored hash is valid is simple but all the other things are hard, for example, whether the additions done to a signed PDF are actually allowed or not.

Or whether the signature is correct in all the small details, e.g. used algorithm, the included information.

And then it sometimes depends on the environment. For example, sometimes a digital signature is only considered valid if all the revocation information and all the certificates are included in the PDF.

PDFBox can do this but to have to build the CLI tool yourself from this example:

https://github.com/apache/pdfbox/blob/5b00807463279f1002e245...

Everything about PDF signatures is maddeningly complex.

not foss, but foxit reader on linux supports signatures

If you're looking for a GUI, the Okular document viewer (by KDE) can sign them just fine, as can LibreOffice (but I don't like how it handles key storage on Linux). For something much more powerful (where you can tweak every possible signature parameter), take a look at jsignpdf - the UI isn't exactly friendly, but it works more reliably than anything else and I've never seen a reader that didn't accept its signature (Adobe Reader likes to sometimes ignore signatures from other tools for no good reason, but never jsignpdf).

As for libraries, you can use jsignpdf from the CLI, PyHanko for Python and probably even more that I don't know.