Native field-lock signing

THPDFHeadlessDocument.SignToFile and SignPFXToFile honour a signature field's local or inherited Lock dictionary and create the corresponding FieldMDP signature reference

All locks every field, Include locks the named fields and their descendants, and Exclude locks every field outside the named fields and their descendants

Each transform uses Type SigRef, TransformMethod FieldMDP, the actual Catalog reference and version 1.2 parameters; a certification signature includes its DocMDP reference in the same Reference array

Field names retain their exact Unicode values and follow the current document string-encryption policy, whilst the cryptographic signature Contents retains its required encryption exception

An authenticated Lock.P permission restricts updates following that signature; earlier stricter DocMDP or Lock permissions continue to apply and cannot be relaxed by a later signature

Policies are parsed and names are validated before a signature is published, whilst subsequent field updates verify the CMS and ESS binding and apply policies from each original authenticated revision

Native signing · Prior-signature validation options · Low-level signature reservation