embedSignature

Write the DER cms into the /Contents hex string of bytes (as produced by saveForSigning with byteRange). The blob must fit the reserved placeholder; the tail keeps its zero padding, which PKCS#7 validators ignore by convention.