Web application to sign PDF documents with digital certificates released by CAs
As tawman described in his answer, the right approach is to have a client-side module in the browser, and have this module do actual signing. You can have signed Java applet or signed ActiveX control to do the job.
We offer such solution for distributed signing with ready to use client modules, but server-side part requires either .NET or VCL (no python, sorry). Our solution doesn't need to transfer the document to the client side (unlike tawman's scheme) - only small chunk of data is sent to the client and signed there. 
Side note: client-side certificate used for authentication as a client via SSL most likely won't work for signing: these two operations require different key usage extension in the certificate.
Immagine a web application written in python/django in which users authenticate with digital certificates via apache+mod_ssl (and a custom django authentication backend), how can they sign files then? The certificates are released by government approved CAs.
If I'm not wrong, a file needs to be signed with the private key of a certificate, because that is the proof that the file has been really signed by someone (and not someone-else pretending to be someone).
How can a web application have access to the private key of a certificate stored in the browser of the user?
Is this possible without the need of a software running on the user's machine?
EDIT:
So this can be done either with an ActiveX control or a Java applet, right? Does this need to be developed from scratch or does anybody know an open source solution?