[Extensibility Request] SignedXml external signing and pre-sign SignedInfo access

Describe the issue

The System Application SignedXml codeunit currently supports computing an XML signature when Business Central has access to the signing key.

However, it does not expose a way to separate XML signature construction from the actual private-key operation.

This prevents use of SignedXml with external signing providers such as:

• remote signing APIs;
• qualified trust service providers;
• hardware security modules;
• centralized signing services;
• other systems where the private key is intentionally not available to Business Central.

For XMLDSIG/XAdES, the external signer must sign the canonicalized SignedInfo produced by the XML signature implementation.

The current public API does not expose:

• the canonicalized/pre-sign SignedInfo data;
• a prepare-signature operation returning the exact data that must be signed;
• or a completion operation allowing a caller to supply an externally produced SignatureValue.

ComputeSignature() therefore couples document construction and the private-key operation.

Expected behavior

SignedXml should support an external-signing workflow where Business Central can construct the signature, obtain the exact data that must be signed externally, and later supply the resulting signature value.

A conceptual API could look like:

PrepareSignature(...)
GetDataToSign(...)
SetSignatureValue(...)
CompleteSignature(...)

The exact API design may differ.

Alternatively, exposing the canonicalized SignedInfo together with a supported way to inject the externally generated SignatureValue would provide the necessary primitive.

The existing ComputeSignature() API should remain available as a convenience for scenarios where Business Central has direct access to the private key.

Steps to reproduce

1. Create an XML document and initialize SignedXml.
2. Configure the required references, transforms, digest methods, KeyInfo, and XML objects.
3. Assume that the private key is held by an external signing service and is not available to Business Central.
4. Attempt to retrieve the canonicalized SignedInfo or equivalent data that must be sent to the external signing service.
5. Observe that no public API exposes this data.
6. Attempt to provide a SignatureValue returned by the external service and complete the XML signature.
7. Observe that no supported public API allows this workflow.

The only available signing operation performs the private-key operation internally.

Additional context

Separating signature-format construction from the private-key operation is a common requirement for modern signing architectures.

In particular, qualified electronic signatures and enterprise signing solutions often use remote signing services or HSM-backed keys where the calling application is deliberately not allowed to access the private key.

Our immediate use case is XAdES creation from AL, but the missing primitive is generic to XMLDSIG.

A useful abstraction would allow the same signature structure to support both:

Business Central prepares SignedInfo
    ↓
local key signs it
    ↓
signature completed

and:

Business Central prepares SignedInfo
    ↓
remote/HSM/QTSP signs it
    ↓
signature returned
    ↓
Business Central completes the XML signature

This would also avoid individual extensions having to implement their own XML canonicalization or XMLDSIG construction merely to use an external signing provider.

We are preparing broader AdES functionality and would be willing to contribute the required System Application change and tests if appropriate.

I will provide a fix for a bug

• I will provide a fix for a bug

Start by locating the System Application SignedXml codeunit and its existing ComputeSignature API. Review how it currently constructs signatures; done means an external-signing workflow can expose the exact pre-sign SignedInfo data and accept an externally produced SignatureValue while preserving ComputeSignature.