Regarding using of certificate to sign other certificates: The answer of @Crypt32 is correct regarding the structure / contents of a certificate.
Regarding "with legal validity": If you use private PKI, this will not be recognizable by the others outside of your organization. Means, it will not have legal validity for the others. When somebody outside your organization clicks on your signature in PDF he will get a message that certificate is not trusted (because very probably they have not added the root certificate of your organization as trusted).
I'd suggest that you consider purchasing signing certificates for your employees. Buying a certificate takes a few minutes. I don't know what you mean by processing. In many companies it looks as follows: Your administrator orders / pays a certificate for an employee and specifies the data of your employee including his/her email. In a few minutes (sometimes in a couple of hours, depending on CA) the employee receives an Email from the CA with a link where he/she can complete generation of certificate within a few minutes. And that's all. You employee has a certificate issues by a recognized CA which is trusted in the most systems and browsers by default.
If you have hundreds or thousands of employees, yes, it will take some time. But it will be done only once a year. Where as setting up the infrastructure can take much time. Besides, you will need some permanent efforts for maintaining it: backups, security patches, regularly auditing permissions, etc.
Regarding money: Each organization has its own meaning of what is expensive. But there are many CAs that provide a 1 year certificate (for document signing) that costs about 10 USD. I don't advertise them here, but you can find them easily by googling.