I am developing a macOS solution that exposes a cloud-backed digital signing credential as a system identity through a persistent CryptoTokenKit token extension. My main goal is to allow third-party macOS applications, especially Adobe Acrobat, to discover the signing identity through the standard macOS Keychain infrastructure and use it for signing PDF documents. Intended signing flow The flow I am trying to implement is: The user adds a cloud signing credential in my macOS container application. My application retrieves the certificate and credential metadata from a remote signing service using the CSC protocol. My application creates or updates the persistent CryptoTokenKit token configuration. The CryptoTokenKit extension exposes the certificate and its associated private-key capability as a macOS system identity. The user opens a PDF document in Adobe Acrobat and starts a digital signature operation. Adobe Acrobat discovers the identity through the standard macOS certificate and Keychain selection flow. The signing request is routed to my CryptoTokenKit token extension. My extension forwards the signing request to the remote CSC signing service and returns the resulting signature. The private key is held by the remote signing infrastructure. It is never stored or exported locally. Environment macOS 26.4.1 (25E253) Xcode 26.4.1 (17E202) Swift Persistent Token Extension created from the Xcode template macOS container application Apple silicon Mac Current implementation issue I have built a prototype consisting of a macOS container application and a persistent CryptoTokenKit token extension. While managing the persistent token configuration, I encountered a reproducible issue with TKTokenDriver.Configuration.driverConfigurations. When I access this API from the container application process, the operation can block indefinitely without returning an error. I tested different threads and dispatch queues, but the behavior remained the same. However, when I execute the same configuration operation from a newly launched helper XPC process, it completes successfully. At this stage, I would first like to confirm that the overall architecture is correct before submitting detailed code and reproduction steps. Questions Is a persistent CryptoTokenKit token extension the Apple-supported architecture for exposing a cloud-backed signing credential as a macOS system identity? What is the recommended Apple-supported pattern for creating and updating persistent TKTokenDriver.Configuration entries? Should this be done directly by the container application, or is a separate process expected? Is there any official Apple sample project or technical guidance covering persistent CryptoTokenKit tokens, network-backed signing and consumption by third-party applications? I have a focused test project and can provide minimal code, logs, process samples and detailed reproduction steps if they are useful. Any architectural guidance, sample code or experience with a similar Adobe Acrobat signing flow would be greatly appreciated. Thank you!