Files to look at:
The PDF Document API allows you to replace a built-in PKCS#7 signature builder (the Pkcs7Signer class) with a custom signer. Refer to the Sign Documents documentation article for more information.
The code sample project shows how to create a Pkcs7SignerBase descendant to implement a custom signer based on the Bouncy Castle C# API and calculate a document hash using a custom digest calculator.
To sign a PDF file using an external web service, retrieve a certificate/certificate chain from the service, and calculate the document hash. Then, sign the calculated document hash with a private key obtained from the external service in the SignDigest method of the BouncyCastleSigner class.