I think you misunderstood me. When I wrote "When a person signs the whole
document, he/she essentially affixes his/her signature in all the places, and
in all roles, where his/her name appears." I did not mean that the
signature(s) would appear anywhere "in" the document. The signature would be
separate but would "cover" the entire document. That would mean that I, as
signer, have "signed" in every place where my name appears in a "signature
line", If I appear in several roles and I have different certificates for
those roles, then I would have to sign the document with my secret key for
each of those roles. Multiple signatures may be accommodated by "nesting"
them. Once I have signed the document, no one can change the places where my
name appears, or does not appear, without invalidating my signature.
Actually, I believe there are standards other than PEM which address the
problems of electronic documents more fully. There are also products in this
area which may do what you want. Perhaps you should pursue those avenues
rather than PEM for your needs.
Charlie