When signing a pdf file, the signature bundle (CMS or our own pgp extension) is placed in the middle of the pdf file.

For this to work, some amount of bytes is reserved in the pdf file to later write the signature into. The amount can be larger than the size of the signature. there is padding available.

Currently in poppler, for the gpgme backend, it is a hardcoded 10'000 bytes, which is larger than any current signatures seen.

For the nss backend in poppler, some maths involving the certificate chain, signature types and such is involved to get a much smaller number in most cases (and the possibility to get a bigger number once PQC and/or larger keys get involved)

It would be nice if gpgme could offer functionality for 'the resulting signature will be less than xxx bytes' to help here.