Contract for pluggable PDF signature providers.
Providers isolate certificate storage and signing infrastructure from the stable PaperForge API. The built-in provider uses Elixir/OTP software keys; applications may replace it with an HSM, KMS, or another signing service.