diff --git a/src/kcfg/settings.kcfg b/src/kcfg/settings.kcfg
index 14c8b801a..a471d165d 100644
--- a/src/kcfg/settings.kcfg
+++ b/src/kcfg/settings.kcfg
@@ -1,86 +1,92 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <kcfg xmlns="http://www.kde.org/standards/kcfg/1.0"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.kde.org/standards/kcfg/1.0
       http://www.kde.org/standards/kcfg/1.0/kcfg.xsd" >
  <kcfgfile name="kleopatrarc" />
  <group name="CertificateCreationWizard">
    <entry key="CN_placeholder" name="cnPlaceholder" type="String">
      <label>Placeholder for CN</label>
      <whatsthis>This text will be used as placeholder text for the common name (CN) field of S/MIME certificates.</whatsthis>
      <default></default>
    </entry>
    <entry key="CN_prefill" name="prefillCN" type="Bool">
      <label>Prefill CN automatically</label>
      <whatsthis>If true, then the common name (CN) field of S/MIME certificates will be prefilled with information gathered from the system,
          e.g., from the email settings of the desktop or, on Windows, from the Active Directory.</whatsthis>
      <default>true</default>
    </entry>
    <entry key="EMAIL_placeholder" name="emailPlaceholder" type="String">
      <label>Placeholder for EMAIL</label>
      <whatsthis>This text will be used as placeholder text for the email address field of OpenPGP and S/MIME certificates.</whatsthis>
      <default></default>
    </entry>
    <entry key="EMAIL_prefill" name="prefillEmail" type="Bool">
      <label>Prefill EMAIL automatically</label>
      <whatsthis>If true, then the email address field of OpenPGP and S/MIME certificates will be prefilled with information gathered from the system,
          e.g., from the email settings of the desktop or, on Windows, from the Active Directory.</whatsthis>
      <default>true</default>
    </entry>
    <entry key="NAME_placeholder" name="namePlaceholder" type="String">
      <label>Placeholder for NAME</label>
      <whatsthis>This text will be used as placeholder text for the name field of OpenPGP certificates.</whatsthis>
      <default></default>
    </entry>
    <entry key="NAME_prefill" name="prefillName" type="Bool">
      <label>Prefill NAME automatically</label>
      <whatsthis>If true, then the name field of OpenPGP certificates will be prefilled with information gathered from the system,
          e.g., from the email settings of the desktop or, on Windows, from the Active Directory.</whatsthis>
      <default>true</default>
    </entry>
  </group>
  <group name="CMS">
    <entry key="Enabled" name="cmsEnabled" type="Bool">
      <label>Enable S/MIME</label>
      <tooltip>Enables support for S/MIME (CMS).</tooltip>
      <whatsthis>If false, then Kleopatra's main UI will not offer any functionality related to S/MIME (CMS).</whatsthis>
      <default>true</default>
    </entry>
    <entry key="AllowCertificateCreation" name="cmsCertificateCreationAllowed" type="Bool">
      <label>Allow S/MIME certificate creation</label>
      <tooltip>Allows the creation of S/MIME certificate signing requests.</tooltip>
      <whatsthis>If false, then Kleopatra will not offer the creation of S/MIME certificate signing requests.</whatsthis>
      <default>true</default>
    </entry>
+   <entry key="AllowSigning" name="cmsSigningAllowed" type="Bool">
+     <label>Allow signing with S/MIME certificates</label>
+     <tooltip>Allows signing of text or files with S/MIME certificates.</tooltip>
+     <whatsthis>If false, then Kleopatra will not offer functionality for creating signatures with S/MIME certificates.</whatsthis>
+     <default>true</default>
+   </entry>
  </group>
  <group name="ConfigurationDialog">
    <entry name="ShowAppearanceConfiguration" type="Bool">
      <label>Show appearance configuration</label>
      <default>true</default>
    </entry>
    <entry name="ShowCryptoOperationsConfiguration" type="Bool">
      <label>Show crypto operations configuration</label>
      <default>true</default>
    </entry>
    <entry name="ShowDirectoryServicesConfiguration" type="Bool">
      <label>Show directory services configuration</label>
      <default>true</default>
    </entry>
    <entry name="ShowGnuPGSystemConfiguration" type="Bool">
      <label>Show GnuPG system configuration</label>
      <default>true</default>
    </entry>
    <entry name="ShowSMimeValidationConfiguration" type="Bool">
      <label>Show S/MIME validation configuration</label>
      <default>true</default>
    </entry>
  </group>
  <group name="Groups">
    <entry name="GroupsEnabled" type="Bool">
      <label>Enable Groups</label>
      <tooltip>Enable usage of groups of keys.</tooltip>
      <whatsthis>Enable usage of groups of keys to create lists of recipients.</whatsthis>
      <default>true</default>
    </entry>
  </group>
 </kcfg>
diff --git a/src/utils/clipboardmenu.cpp b/src/utils/clipboardmenu.cpp
index 651be08e1..3a693cd93 100644
--- a/src/utils/clipboardmenu.cpp
+++ b/src/utils/clipboardmenu.cpp
@@ -1,122 +1,123 @@
 /*
   SPDX-FileCopyrightText: 2014-2021 Laurent Montel <montel@kde.org>
 
   SPDX-License-Identifier: GPL-2.0-only
 */
 
 #include "clipboardmenu.h"
 
 #include "kdtoolsglobal.h"
 #include "mainwindow.h"
 
 #include <settings.h>
 
 #include <commands/importcertificatefromclipboardcommand.h>
 #include <commands/encryptclipboardcommand.h>
 #include <commands/signclipboardcommand.h>
 #include <commands/decryptverifyclipboardcommand.h>
 
 #include <KLocalizedString>
 #include <KActionMenu>
 
 #include <QAction>
 #include <QApplication>
 #include <QClipboard>
 #include <QSignalBlocker>
 
 using namespace Kleo;
 
 using namespace Kleo::Commands;
 
 ClipboardMenu::ClipboardMenu(QObject *parent)
     : QObject{parent}
 {
     mClipboardMenu = new KActionMenu(i18n("Clipboard"), this);
     mImportClipboardAction = new QAction(i18n("Certificate Import"), this);
     mEncryptClipboardAction = new QAction(i18n("Encrypt..."), this);
-    if (Settings{}.cmsEnabled()) {
+    const Kleo::Settings settings{};
+    if (settings.cmsEnabled() && settings.cmsSigningAllowed()) {
         mSmimeSignClipboardAction = new QAction(i18n("S/MIME-Sign..."), this);
     }
     mOpenPGPSignClipboardAction = new QAction(i18n("OpenPGP-Sign..."), this);
     mDecryptVerifyClipboardAction = new QAction(i18n("Decrypt/Verify..."), this);
 
     KDAB_SET_OBJECT_NAME(mClipboardMenu);
     KDAB_SET_OBJECT_NAME(mImportClipboardAction);
     KDAB_SET_OBJECT_NAME(mEncryptClipboardAction);
     KDAB_SET_OBJECT_NAME(mSmimeSignClipboardAction);
     KDAB_SET_OBJECT_NAME(mOpenPGPSignClipboardAction);
     KDAB_SET_OBJECT_NAME(mDecryptVerifyClipboardAction);
 
     connect(mImportClipboardAction, &QAction::triggered, this, &ClipboardMenu::slotImportClipboard);
     connect(mEncryptClipboardAction, &QAction::triggered, this, &ClipboardMenu::slotEncryptClipboard);
     if (mSmimeSignClipboardAction) {
         connect(mSmimeSignClipboardAction, &QAction::triggered, this, &ClipboardMenu::slotSMIMESignClipboard);
     }
     connect(mOpenPGPSignClipboardAction, &QAction::triggered, this, &ClipboardMenu::slotOpenPGPSignClipboard);
     connect(mDecryptVerifyClipboardAction, &QAction::triggered, this, &ClipboardMenu::slotDecryptVerifyClipboard);
     mClipboardMenu->addAction(mImportClipboardAction);
     mClipboardMenu->addAction(mEncryptClipboardAction);
     if (mSmimeSignClipboardAction) {
         mClipboardMenu->addAction(mSmimeSignClipboardAction);
     }
     mClipboardMenu->addAction(mOpenPGPSignClipboardAction);
     mClipboardMenu->addAction(mDecryptVerifyClipboardAction);
     connect(QApplication::clipboard(), &QClipboard::changed, this, &ClipboardMenu::slotEnableDisableActions);
     slotEnableDisableActions();
 }
 
 ClipboardMenu::~ClipboardMenu() = default;
 
 void ClipboardMenu::setMainWindow(MainWindow *window)
 {
     mWindow = window;
 }
 
 KActionMenu *ClipboardMenu::clipboardMenu() const
 {
     return mClipboardMenu;
 }
 
 void ClipboardMenu::startCommand(Command *cmd)
 {
     Q_ASSERT(cmd);
     cmd->setParent(mWindow);
     cmd->start();
 }
 
 void ClipboardMenu::slotImportClipboard()
 {
     startCommand(new ImportCertificateFromClipboardCommand(nullptr));
 }
 
 void ClipboardMenu::slotEncryptClipboard()
 {
     startCommand(new EncryptClipboardCommand(nullptr));
 }
 
 void ClipboardMenu::slotOpenPGPSignClipboard()
 {
     startCommand(new SignClipboardCommand(GpgME::OpenPGP, nullptr));
 }
 
 void ClipboardMenu::slotSMIMESignClipboard()
 {
     startCommand(new SignClipboardCommand(GpgME::CMS, nullptr));
 }
 
 void ClipboardMenu::slotDecryptVerifyClipboard()
 {
     startCommand(new DecryptVerifyClipboardCommand(nullptr));
 }
 
 void ClipboardMenu::slotEnableDisableActions()
 {
     const QSignalBlocker blocker(QApplication::clipboard());
     mImportClipboardAction->setEnabled(ImportCertificateFromClipboardCommand::canImportCurrentClipboard());
     mEncryptClipboardAction->setEnabled(EncryptClipboardCommand::canEncryptCurrentClipboard());
     mOpenPGPSignClipboardAction->setEnabled(SignClipboardCommand::canSignCurrentClipboard());
     if (mSmimeSignClipboardAction) {
         mSmimeSignClipboardAction->setEnabled(SignClipboardCommand::canSignCurrentClipboard());
     }
     mDecryptVerifyClipboardAction->setEnabled(DecryptVerifyClipboardCommand::canDecryptVerifyCurrentClipboard());
 }