Version 3.1.0

Packaging-focused release: the fat jar is gone and every supported platform ships a native installer with its own bundled Java runtime. Also introduces a pluggable signing-engine architecture with a new EU DSS (PAdES) engine.

• Per-platform native installers built with jpackage and a bundled Zulu+FX 21 runtime, so no system Java is required: Windows MSI, Linux DEB and RPM, and macOS DMG, each alongside a portable ZIP. Flatpak bundles are published for Linux x64 and aarch64.
• Two cross-platform ZIPs for users who already have Java 21: a full ZIP carrying JavaFX natives for all platforms (with a Swing fallback when none match) and a minimal ZIP without JavaFX for headless/CLI signing and downstream packagers.
• Fat jar dropped — the shaded all-in-one jar is no longer produced; the cross-platform ZIPs use bin/jsignpdf.sh and bin\jsignpdf.cmd launchers instead. The library jar published to Maven Central is unchanged.
• Pluggable signing engines selectable with the new --list-engines and -eng / --engine options or the Engine selector in Preferences. JSignPdf ships OpenPDF as the default engine.
• New EU DSS (PAdES) engine (id dss) producing PAdES signatures at the ETSI baseline levels B, T, LT, and LTA, which the OpenPDF engine cannot create.
• Default hash algorithm is now SHA-256 (was SHA-1) for signing that relies on the implicit default. An explicit or saved hash.algorithm is untouched, and SHA-1 stays selectable for the OpenPDF engine.
• CLI signatures now append by default, matching the GUI. Use the new --overwrite flag to replace existing signatures; the legacy --append / -a flag is kept as a no-op.
• Signed Windows installers — the Windows MSI installers are Authenticode-signed via SignPath, so they install without an unknown-publisher warning. Pre-release builds ship unsigned.
• Configurable default output suffix — the _signed marker appended to the output file name can now be changed with the new output.suffix key in advanced.properties, so non-English users can localize it (e.g. _firmado). It feeds both GUIs and the default for the CLI -os / --out-suffix option.
• Checksums for every artifact — a jsignpdf-<version>-SHA256SUMS.txt file now covers all published release assets.