The certificate should represent us as a company.

In the future we might want to add the possibility for the clients to provide their own certificate to be able to add a personal signing as well.

1. How do I get hold of a trusted certificate for this use? Our regular SSL cert for the server API is issued by Amazon. I don't think they'll issue anything else but certificates for the domains we have registered with them.

2. When problem 1 is solved: How do I embed enough information in the PDF so the verification can be done even after the certificate has expired? See "Establish long-term signature validation" at the following link:

https://helpx.adobe.com/acrobat/using/validating-digital-signatures.html#validate_a_digital_signature

How do I get hold of a trusted certificate for this use? Our regular SSL cert for the server API is issued by Amazon. I don't think they'll issue anything else but certificates for the domains we have registered with them.

I don't have any experience here. I see here some notes and option to purchase but haven't tried it
https://www.sslmarket.com/ssl/aatl-certificates-for-trusted-pdf-signing

I'm busy now to try this out, but if you go through the process, please write down notes and share it.
We will happily add it to the documentation then.

When problem 1 is solved: How do I embed enough information in the PDF so the verification can be done even after the certificate has expired? See "Establish long-term signature validation" at the following link:

It seems the long term validation is enabled by default. Am I missing something?

Either way we'll have to wait until the underlaying bug is fixed so we can sign and password protect the pdfs at the same time. (see: https://forum.jsreport.net/topic/1817/how-to-use-pdfpassword-successfully).

Having LTV enabled by default is great. I didn't see this because I tested with a private cert.