My organisation, say Acme, is building an e-signature platform where global businesses sign up and use the platform to send out e-signature requests. And when signers in a particular e-sign request sign the document, Acme must digitally sign the document too. Acme needs to do this for all the documents for all the customers that are e-signed through the platform (roughly ~100K per month, for example).
To enable this scenario, I am exploring document-signing certificates and certificate authorities who issue such certificates. Looking at the pricing pages of CAs like entrust and digicert, it appears that they have a cap of x document signing events per year/month.
Speaking with their support, I've learned that they support two types of signing, but both are capped.
- Traditionally issued file-based certificate - where the CA provides the HSM with the certificate file, which Acme uses to sign the document.
- Cloud-based certificate - where Acme requests them via API with the document hash and the CA issue the certificate.
In both cases, a cap of, say, 10000 signing events annually is applied. How could they track the signing events if Acme digitally signs with the traditional certificate file provided? Shouldn't Acme be able to sign infinite documents within the certificate's validity theoretically? Is there a better feasible way to implement it so that Acme only pays for the certificate and theoretically digitally signs infinite documents?