I remember Okular having a decent set of features. It might be worth checking out. The webpage says it supports digital signing, which is a suprise to me because that's always been a hassle on linux for me. https://okular.kde.org/

in this decade my worst Linux experience has been attempting to digitally sign a document what a wasteland of decrepit and poorly documented tools

The law firm that I work for is has finally decided that we should embrace Linux.

Never thought I'd read this sentence. I don't have any recommendations, just wanted to say congrats on achieving the unthinkable!

BentoPDF - bentopdf.com. It can handle anything you might need to do with a PDF. It requires docker, but thats easy enough to do on an individual machine. Your corporate setting adds some complications no doubt, and they may be looking for an actual company-backed app. I'm not very familiar with the commercial PDF editor market.

Bonus points: It's a non-American company

As an American, keep doing this. Make it fucking hurt them. A lot.

If you'd be fine with having a docker container running, have a look at Signature PDF.

I've been using it to manipulate pdfs in similar ways you described and put it on a pi in my homenetwork (autostarting docker would also work).

They have a tester here.

(Also: french open source project)