ASP-C# X.509 Document Signing

I have an ASP.NET (C#) Web API that generates PDF and XML documents which must leave the server already signed with an X.509 certificate issued by our own internal CA. The core plumbing is there, but the signature step is still incomplete.

What I need now is the final piece that will:
• Apply an X.509 signature at an advanced security level that passes strict validation in Adobe Reader and common XML-signature validators.
• Integrate cleanly with the existing controller so that a simple call (e.g., SignAndSendAsync) returns the signed file stream.
• Rely on the certificate and private key stored in our internal CA chain (PFX is available, plus root and intermediate certificates).

Please keep the work in pure C#—preferably using System.Security.Cryptography or BouncyCastle—and document the handful of methods added or modified so I can maintain them later. Unit-test coverage for a happy-path signing scenario will be the acceptance criteria.