Version 3.2.0

A feature release. You can now sign into a form’s existing signature fields, add or refresh a document timestamp without signing at all, and see a live preview of the visible signature as you place it — plus more control over output, better diagnostics, and a batch of signing and appearance fixes.

• Sign into an existing signature field — documents that pre-place a signature box per signer can now be signed into it instead of getting a new field on top. Pick it from the Signature field combo in the JavaFX Signature Appearance panel, or with --sig-field (--list-sig-fields prints what a document offers); the field’s own rectangle and page are used. Both engines support it. See issue 223.
• Append a document timestamp without signing — jsignpdf -eng dss --timestamp-only -ts <URL> doc.pdf adds an ETSI.RFC3161 document timestamp to any PDF with no key, to give it a trusted point in time or to refresh a PAdES B-LTA archive timestamp before its TSA certificate expires. In the UI it’s the Timestamp toolbar button and Signing > Add Timestamp… (Ctrl+T). Needs the DSS engine. See issue 141.
• Live preview of the visible signature — the signature text and background image are rendered inside the rectangle on the page preview while you place, move and resize it, pages are rasterized at print resolution (300 DPI), and empty signature fields are shaded so you can see where a form author placed them. See issue 479.
• Choose where the signed file goes — the GUI gains an Output directory field and a suffix on/off switch, with a warning when the resulting name would overwrite the input; under Flatpak the chosen directory is granted through the desktop portal. See issue 483.
• PSS-only certificates sign correctly on hardware tokens (DSS engine) — a certificate marked id-RSASSA-PSS, as eIDAS qualified certificates increasingly are, previously failed to sign on PKCS#11 tokens with a SignatureAlgorithm ... does not match error; the DSS engine now takes the algorithm from the certificate and produces real PSS. See issue 255.
• New debug output for signing diagnostics — enable it on the new General tab of Preferences or with -o debug=true to log the signing certificate chain and, for the DSS engine, every AIA/CRL/OCSP request and the trust anchors it loaded. Off by default. See issue 452.
• Other improvements — pick the interface language with the new Language selector (ui.language, issue 444); sign very large PDFs without a bigger heap via buffering.mode=temp (issue 178); the DSS engine now layers a background image behind the signature graphic and auto-scales text to fit the box (issue 433); DSS timestamp requests carry a nonce (issue 33); visible-signature images keep their aspect ratio on the DSS engine (issue 460) and description text fills the whole box on OpenPDF (issue 479); append mode no longer refuses to sign when it can’t bump the declared PDF version (issue 467); clear the Recent files list on its own (issue 453); and the bundled Norwegian Bokmål translation now actually loads.