diff --git a/apps/cloud_federation_api/lib/Controller/OCMRequestController.php b/apps/cloud_federation_api/lib/Controller/OCMRequestController.php
index 90d10df2c2bde..4e8671b0fbcc6 100644
--- a/apps/cloud_federation_api/lib/Controller/OCMRequestController.php
+++ b/apps/cloud_federation_api/lib/Controller/OCMRequestController.php
@@ -10,7 +10,6 @@
 namespace OCA\CloudFederationAPI\Controller;
 
 use JsonException;
-use NCU\Security\Signature\Exceptions\IncomingRequestException;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\Attribute\BruteForceProtection;
@@ -24,6 +23,7 @@
 use OCP\OCM\Events\OCMEndpointRequestEvent;
 use OCP\OCM\Exceptions\OCMArgumentException;
 use OCP\OCM\IOCMDiscoveryService;
+use OCP\Security\Signature\Exceptions\IncomingRequestException;
 use Psr\Log\LoggerInterface;
 
 class OCMRequestController extends Controller {
diff --git a/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php b/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php
index 2f0f9f667aa69..bfccb2fe20eaf 100644
--- a/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php
+++ b/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php
@@ -7,12 +7,6 @@
 
 namespace OCA\CloudFederationAPI\Controller;
 
-use NCU\Federation\ISignedCloudFederationProvider;
-use NCU\Security\Signature\Exceptions\IdentityNotFoundException;
-use NCU\Security\Signature\Exceptions\IncomingRequestException;
-use NCU\Security\Signature\Exceptions\SignatoryNotFoundException;
-use NCU\Security\Signature\IIncomingSignedRequest;
-use NCU\Security\Signature\ISignatureManager;
 use OC\OCM\OCMSignatoryManager;
 use OCA\CloudFederationAPI\Config;
 use OCA\CloudFederationAPI\Db\FederatedInviteMapper;
@@ -37,12 +31,18 @@
 use OCP\Federation\ICloudFederationFactory;
 use OCP\Federation\ICloudFederationProviderManager;
 use OCP\Federation\ICloudIdManager;
+use OCP\Federation\ISignedCloudFederationProvider;
 use OCP\IAppConfig;
 use OCP\IGroupManager;
 use OCP\IRequest;
 use OCP\IURLGenerator;
 use OCP\IUserManager;
 use OCP\OCM\IOCMDiscoveryService;
+use OCP\Security\Signature\Exceptions\IdentityNotFoundException;
+use OCP\Security\Signature\Exceptions\IncomingRequestException;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\IIncomingSignedRequest;
+use OCP\Security\Signature\ISignatureManager;
 use OCP\Share\Exceptions\ShareNotFound;
 use OCP\Util;
 use Psr\Log\LoggerInterface;
diff --git a/apps/cloud_federation_api/tests/RequestHandlerControllerTest.php b/apps/cloud_federation_api/tests/RequestHandlerControllerTest.php
index 81557119925fd..04cabbd234c25 100644
--- a/apps/cloud_federation_api/tests/RequestHandlerControllerTest.php
+++ b/apps/cloud_federation_api/tests/RequestHandlerControllerTest.php
@@ -9,7 +9,6 @@
 
 namespace OCA\CloudFederationApi\Tests;
 
-use NCU\Security\Signature\ISignatureManager;
 use OCA\CloudFederationAPI\Config;
 use OCA\CloudFederationAPI\Controller\RequestHandlerController;
 use OCA\CloudFederationAPI\Db\FederatedInvite;
@@ -29,6 +28,7 @@
 use OCP\IUser;
 use OCP\IUserManager;
 use OCP\OCM\IOCMDiscoveryService;
+use OCP\Security\Signature\ISignatureManager;
 use PHPUnit\Framework\MockObject\MockObject;
 use Psr\Log\LoggerInterface;
 use Test\TestCase;
diff --git a/apps/federatedfilesharing/lib/OCM/CloudFederationProviderFiles.php b/apps/federatedfilesharing/lib/OCM/CloudFederationProviderFiles.php
index 724deb553a216..30da7befa8fc5 100644
--- a/apps/federatedfilesharing/lib/OCM/CloudFederationProviderFiles.php
+++ b/apps/federatedfilesharing/lib/OCM/CloudFederationProviderFiles.php
@@ -6,7 +6,6 @@
  */
 namespace OCA\FederatedFileSharing\OCM;
 
-use NCU\Federation\ISignedCloudFederationProvider;
 use OC\AppFramework\Http;
 use OC\Files\Filesystem;
 use OC\Files\SetupManager;
@@ -30,6 +29,7 @@
 use OCP\Federation\ICloudFederationProviderManager;
 use OCP\Federation\ICloudFederationShare;
 use OCP\Federation\ICloudIdManager;
+use OCP\Federation\ISignedCloudFederationProvider;
 use OCP\Files\IFilenameValidator;
 use OCP\Files\NotFoundException;
 use OCP\HintException;
diff --git a/lib/composer/composer/autoload_classmap.php b/lib/composer/composer/autoload_classmap.php
index 27b42cb14b75d..beb3d02749dd4 100644
--- a/lib/composer/composer/autoload_classmap.php
+++ b/lib/composer/composer/autoload_classmap.php
@@ -386,6 +386,7 @@
     'OCP\\Federation\\ICloudId' => $baseDir . '/lib/public/Federation/ICloudId.php',
     'OCP\\Federation\\ICloudIdManager' => $baseDir . '/lib/public/Federation/ICloudIdManager.php',
     'OCP\\Federation\\ICloudIdResolver' => $baseDir . '/lib/public/Federation/ICloudIdResolver.php',
+    'OCP\\Federation\\ISignedCloudFederationProvider' => $baseDir . '/lib/public/Federation/ISignedCloudFederationProvider.php',
     'OCP\\Files' => $baseDir . '/lib/public/Files.php',
     'OCP\\FilesMetadata\\AMetadataEvent' => $baseDir . '/lib/public/FilesMetadata/AMetadataEvent.php',
     'OCP\\FilesMetadata\\Event\\MetadataBackgroundEvent' => $baseDir . '/lib/public/FilesMetadata/Event/MetadataBackgroundEvent.php',
@@ -792,6 +793,26 @@
     'OCP\\Security\\PasswordContext' => $baseDir . '/lib/public/Security/PasswordContext.php',
     'OCP\\Security\\RateLimiting\\ILimiter' => $baseDir . '/lib/public/Security/RateLimiting/ILimiter.php',
     'OCP\\Security\\RateLimiting\\IRateLimitExceededException' => $baseDir . '/lib/public/Security/RateLimiting/IRateLimitExceededException.php',
+    'OCP\\Security\\Signature\\Enum\\DigestAlgorithm' => $baseDir . '/lib/public/Security/Signature/Enum/DigestAlgorithm.php',
+    'OCP\\Security\\Signature\\Enum\\SignatoryStatus' => $baseDir . '/lib/public/Security/Signature/Enum/SignatoryStatus.php',
+    'OCP\\Security\\Signature\\Enum\\SignatoryType' => $baseDir . '/lib/public/Security/Signature/Enum/SignatoryType.php',
+    'OCP\\Security\\Signature\\Enum\\SignatureAlgorithm' => $baseDir . '/lib/public/Security/Signature/Enum/SignatureAlgorithm.php',
+    'OCP\\Security\\Signature\\Exceptions\\IdentityNotFoundException' => $baseDir . '/lib/public/Security/Signature/Exceptions/IdentityNotFoundException.php',
+    'OCP\\Security\\Signature\\Exceptions\\IncomingRequestException' => $baseDir . '/lib/public/Security/Signature/Exceptions/IncomingRequestException.php',
+    'OCP\\Security\\Signature\\Exceptions\\InvalidKeyOriginException' => $baseDir . '/lib/public/Security/Signature/Exceptions/InvalidKeyOriginException.php',
+    'OCP\\Security\\Signature\\Exceptions\\InvalidSignatureException' => $baseDir . '/lib/public/Security/Signature/Exceptions/InvalidSignatureException.php',
+    'OCP\\Security\\Signature\\Exceptions\\SignatoryConflictException' => $baseDir . '/lib/public/Security/Signature/Exceptions/SignatoryConflictException.php',
+    'OCP\\Security\\Signature\\Exceptions\\SignatoryException' => $baseDir . '/lib/public/Security/Signature/Exceptions/SignatoryException.php',
+    'OCP\\Security\\Signature\\Exceptions\\SignatoryNotFoundException' => $baseDir . '/lib/public/Security/Signature/Exceptions/SignatoryNotFoundException.php',
+    'OCP\\Security\\Signature\\Exceptions\\SignatureElementNotFoundException' => $baseDir . '/lib/public/Security/Signature/Exceptions/SignatureElementNotFoundException.php',
+    'OCP\\Security\\Signature\\Exceptions\\SignatureException' => $baseDir . '/lib/public/Security/Signature/Exceptions/SignatureException.php',
+    'OCP\\Security\\Signature\\Exceptions\\SignatureNotFoundException' => $baseDir . '/lib/public/Security/Signature/Exceptions/SignatureNotFoundException.php',
+    'OCP\\Security\\Signature\\IIncomingSignedRequest' => $baseDir . '/lib/public/Security/Signature/IIncomingSignedRequest.php',
+    'OCP\\Security\\Signature\\IOutgoingSignedRequest' => $baseDir . '/lib/public/Security/Signature/IOutgoingSignedRequest.php',
+    'OCP\\Security\\Signature\\ISignatoryManager' => $baseDir . '/lib/public/Security/Signature/ISignatoryManager.php',
+    'OCP\\Security\\Signature\\ISignatureManager' => $baseDir . '/lib/public/Security/Signature/ISignatureManager.php',
+    'OCP\\Security\\Signature\\ISignedRequest' => $baseDir . '/lib/public/Security/Signature/ISignedRequest.php',
+    'OCP\\Security\\Signature\\Model\\Signatory' => $baseDir . '/lib/public/Security/Signature/Model/Signatory.php',
     'OCP\\Security\\VerificationToken\\IVerificationToken' => $baseDir . '/lib/public/Security/VerificationToken/IVerificationToken.php',
     'OCP\\Security\\VerificationToken\\InvalidTokenException' => $baseDir . '/lib/public/Security/VerificationToken/InvalidTokenException.php',
     'OCP\\Server' => $baseDir . '/lib/public/Server.php',
diff --git a/lib/composer/composer/autoload_static.php b/lib/composer/composer/autoload_static.php
index 03bd8e7d0bf64..ff0f8b124ba7e 100644
--- a/lib/composer/composer/autoload_static.php
+++ b/lib/composer/composer/autoload_static.php
@@ -427,6 +427,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OCP\\Federation\\ICloudId' => __DIR__ . '/../../..' . '/lib/public/Federation/ICloudId.php',
         'OCP\\Federation\\ICloudIdManager' => __DIR__ . '/../../..' . '/lib/public/Federation/ICloudIdManager.php',
         'OCP\\Federation\\ICloudIdResolver' => __DIR__ . '/../../..' . '/lib/public/Federation/ICloudIdResolver.php',
+        'OCP\\Federation\\ISignedCloudFederationProvider' => __DIR__ . '/../../..' . '/lib/public/Federation/ISignedCloudFederationProvider.php',
         'OCP\\Files' => __DIR__ . '/../../..' . '/lib/public/Files.php',
         'OCP\\FilesMetadata\\AMetadataEvent' => __DIR__ . '/../../..' . '/lib/public/FilesMetadata/AMetadataEvent.php',
         'OCP\\FilesMetadata\\Event\\MetadataBackgroundEvent' => __DIR__ . '/../../..' . '/lib/public/FilesMetadata/Event/MetadataBackgroundEvent.php',
@@ -833,6 +834,26 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OCP\\Security\\PasswordContext' => __DIR__ . '/../../..' . '/lib/public/Security/PasswordContext.php',
         'OCP\\Security\\RateLimiting\\ILimiter' => __DIR__ . '/../../..' . '/lib/public/Security/RateLimiting/ILimiter.php',
         'OCP\\Security\\RateLimiting\\IRateLimitExceededException' => __DIR__ . '/../../..' . '/lib/public/Security/RateLimiting/IRateLimitExceededException.php',
+        'OCP\\Security\\Signature\\Enum\\DigestAlgorithm' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Enum/DigestAlgorithm.php',
+        'OCP\\Security\\Signature\\Enum\\SignatoryStatus' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Enum/SignatoryStatus.php',
+        'OCP\\Security\\Signature\\Enum\\SignatoryType' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Enum/SignatoryType.php',
+        'OCP\\Security\\Signature\\Enum\\SignatureAlgorithm' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Enum/SignatureAlgorithm.php',
+        'OCP\\Security\\Signature\\Exceptions\\IdentityNotFoundException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/IdentityNotFoundException.php',
+        'OCP\\Security\\Signature\\Exceptions\\IncomingRequestException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/IncomingRequestException.php',
+        'OCP\\Security\\Signature\\Exceptions\\InvalidKeyOriginException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/InvalidKeyOriginException.php',
+        'OCP\\Security\\Signature\\Exceptions\\InvalidSignatureException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/InvalidSignatureException.php',
+        'OCP\\Security\\Signature\\Exceptions\\SignatoryConflictException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/SignatoryConflictException.php',
+        'OCP\\Security\\Signature\\Exceptions\\SignatoryException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/SignatoryException.php',
+        'OCP\\Security\\Signature\\Exceptions\\SignatoryNotFoundException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/SignatoryNotFoundException.php',
+        'OCP\\Security\\Signature\\Exceptions\\SignatureElementNotFoundException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/SignatureElementNotFoundException.php',
+        'OCP\\Security\\Signature\\Exceptions\\SignatureException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/SignatureException.php',
+        'OCP\\Security\\Signature\\Exceptions\\SignatureNotFoundException' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Exceptions/SignatureNotFoundException.php',
+        'OCP\\Security\\Signature\\IIncomingSignedRequest' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/IIncomingSignedRequest.php',
+        'OCP\\Security\\Signature\\IOutgoingSignedRequest' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/IOutgoingSignedRequest.php',
+        'OCP\\Security\\Signature\\ISignatoryManager' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/ISignatoryManager.php',
+        'OCP\\Security\\Signature\\ISignatureManager' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/ISignatureManager.php',
+        'OCP\\Security\\Signature\\ISignedRequest' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/ISignedRequest.php',
+        'OCP\\Security\\Signature\\Model\\Signatory' => __DIR__ . '/../../..' . '/lib/public/Security/Signature/Model/Signatory.php',
         'OCP\\Security\\VerificationToken\\IVerificationToken' => __DIR__ . '/../../..' . '/lib/public/Security/VerificationToken/IVerificationToken.php',
         'OCP\\Security\\VerificationToken\\InvalidTokenException' => __DIR__ . '/../../..' . '/lib/public/Security/VerificationToken/InvalidTokenException.php',
         'OCP\\Server' => __DIR__ . '/../../..' . '/lib/public/Server.php',
diff --git a/lib/private/Federation/CloudFederationProviderManager.php b/lib/private/Federation/CloudFederationProviderManager.php
index ca5161fd7dba0..f0dcf8ce4116c 100644
--- a/lib/private/Federation/CloudFederationProviderManager.php
+++ b/lib/private/Federation/CloudFederationProviderManager.php
@@ -8,7 +8,6 @@
  */
 namespace OC\Federation;
 
-use NCU\Security\Signature\ISignatureManager;
 use OC\AppFramework\Http;
 use OC\OCM\OCMSignatoryManager;
 use OCP\App\IAppManager;
@@ -26,6 +25,7 @@
 use OCP\OCM\Exceptions\OCMCapabilityException;
 use OCP\OCM\Exceptions\OCMProviderException;
 use OCP\OCM\IOCMDiscoveryService;
+use OCP\Security\Signature\ISignatureManager;
 use Psr\Log\LoggerInterface;
 
 /**
diff --git a/lib/private/OCM/Model/OCMProvider.php b/lib/private/OCM/Model/OCMProvider.php
index 3159f382ad8aa..bbbace0d882c6 100644
--- a/lib/private/OCM/Model/OCMProvider.php
+++ b/lib/private/OCM/Model/OCMProvider.php
@@ -9,11 +9,11 @@
 
 namespace OC\OCM\Model;
 
-use NCU\Security\Signature\Model\Signatory;
 use OCP\OCM\Exceptions\OCMArgumentException;
 use OCP\OCM\Exceptions\OCMProviderException;
 use OCP\OCM\IOCMProvider;
 use OCP\OCM\IOCMResource;
+use OCP\Security\Signature\Model\Signatory;
 
 /**
  * @since 28.0.0
diff --git a/lib/private/OCM/OCMDiscoveryService.php b/lib/private/OCM/OCMDiscoveryService.php
index ec8d20d2aee75..0164ab88241d8 100644
--- a/lib/private/OCM/OCMDiscoveryService.php
+++ b/lib/private/OCM/OCMDiscoveryService.php
@@ -12,14 +12,6 @@
 use Exception;
 use GuzzleHttp\Exception\ConnectException;
 use JsonException;
-use NCU\Security\Signature\Exceptions\IdentityNotFoundException;
-use NCU\Security\Signature\Exceptions\IncomingRequestException;
-use NCU\Security\Signature\Exceptions\SignatoryException;
-use NCU\Security\Signature\Exceptions\SignatoryNotFoundException;
-use NCU\Security\Signature\Exceptions\SignatureException;
-use NCU\Security\Signature\Exceptions\SignatureNotFoundException;
-use NCU\Security\Signature\IIncomingSignedRequest;
-use NCU\Security\Signature\ISignatureManager;
 use OC\Core\AppInfo\ConfigLexicon;
 use OC\OCM\Model\OCMProvider;
 use OCP\AppFramework\Attribute\Consumable;
@@ -40,6 +32,14 @@
 use OCP\OCM\Exceptions\OCMRequestException;
 use OCP\OCM\IOCMDiscoveryService;
 use OCP\OCM\IOCMProvider;
+use OCP\Security\Signature\Exceptions\IdentityNotFoundException;
+use OCP\Security\Signature\Exceptions\IncomingRequestException;
+use OCP\Security\Signature\Exceptions\SignatoryException;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureException;
+use OCP\Security\Signature\Exceptions\SignatureNotFoundException;
+use OCP\Security\Signature\IIncomingSignedRequest;
+use OCP\Security\Signature\ISignatureManager;
 use Psr\Log\LoggerInterface;
 
 /**
diff --git a/lib/private/OCM/OCMSignatoryManager.php b/lib/private/OCM/OCMSignatoryManager.php
index 0acdd17863503..e9926ff6622b8 100644
--- a/lib/private/OCM/OCMSignatoryManager.php
+++ b/lib/private/OCM/OCMSignatoryManager.php
@@ -9,17 +9,17 @@
 
 namespace OC\OCM;
 
-use NCU\Security\Signature\Enum\DigestAlgorithm;
-use NCU\Security\Signature\Enum\SignatoryType;
-use NCU\Security\Signature\Enum\SignatureAlgorithm;
-use NCU\Security\Signature\Exceptions\IdentityNotFoundException;
-use NCU\Security\Signature\ISignatoryManager;
-use NCU\Security\Signature\ISignatureManager;
-use NCU\Security\Signature\Model\Signatory;
 use OC\Security\IdentityProof\Manager;
 use OCP\IAppConfig;
 use OCP\IURLGenerator;
 use OCP\OCM\Exceptions\OCMProviderException;
+use OCP\Security\Signature\Enum\DigestAlgorithm;
+use OCP\Security\Signature\Enum\SignatoryType;
+use OCP\Security\Signature\Enum\SignatureAlgorithm;
+use OCP\Security\Signature\Exceptions\IdentityNotFoundException;
+use OCP\Security\Signature\ISignatoryManager;
+use OCP\Security\Signature\ISignatureManager;
+use OCP\Security\Signature\Model\Signatory;
 use OCP\Server;
 use Psr\Container\ContainerExceptionInterface;
 use Psr\Container\NotFoundExceptionInterface;
diff --git a/lib/private/Security/Signature/Db/SignatoryMapper.php b/lib/private/Security/Signature/Db/SignatoryMapper.php
index 47b7932054824..209acb13134a2 100644
--- a/lib/private/Security/Signature/Db/SignatoryMapper.php
+++ b/lib/private/Security/Signature/Db/SignatoryMapper.php
@@ -8,12 +8,12 @@
 
 namespace OC\Security\Signature\Db;
 
-use NCU\Security\Signature\Exceptions\SignatoryNotFoundException;
-use NCU\Security\Signature\Model\Signatory;
 use OCP\AppFramework\Db\DoesNotExistException;
 use OCP\AppFramework\Db\QBMapper;
 use OCP\DB\Exception;
 use OCP\IDBConnection;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\Model\Signatory;
 
 /**
  * @template-extends QBMapper<Signatory>
diff --git a/lib/private/Security/Signature/Model/IncomingSignedRequest.php b/lib/private/Security/Signature/Model/IncomingSignedRequest.php
index 0f7dc7cb77154..ab2c6f708a1bb 100644
--- a/lib/private/Security/Signature/Model/IncomingSignedRequest.php
+++ b/lib/private/Security/Signature/Model/IncomingSignedRequest.php
@@ -9,20 +9,20 @@
 namespace OC\Security\Signature\Model;
 
 use JsonSerializable;
-use NCU\Security\Signature\Enum\DigestAlgorithm;
-use NCU\Security\Signature\Enum\SignatureAlgorithm;
-use NCU\Security\Signature\Exceptions\IdentityNotFoundException;
-use NCU\Security\Signature\Exceptions\IncomingRequestException;
-use NCU\Security\Signature\Exceptions\InvalidSignatureException;
-use NCU\Security\Signature\Exceptions\SignatoryNotFoundException;
-use NCU\Security\Signature\Exceptions\SignatureElementNotFoundException;
-use NCU\Security\Signature\Exceptions\SignatureException;
-use NCU\Security\Signature\Exceptions\SignatureNotFoundException;
-use NCU\Security\Signature\IIncomingSignedRequest;
-use NCU\Security\Signature\ISignatureManager;
-use NCU\Security\Signature\Model\Signatory;
 use OC\Security\Signature\SignatureManager;
 use OCP\IRequest;
+use OCP\Security\Signature\Enum\DigestAlgorithm;
+use OCP\Security\Signature\Enum\SignatureAlgorithm;
+use OCP\Security\Signature\Exceptions\IdentityNotFoundException;
+use OCP\Security\Signature\Exceptions\IncomingRequestException;
+use OCP\Security\Signature\Exceptions\InvalidSignatureException;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureElementNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureException;
+use OCP\Security\Signature\Exceptions\SignatureNotFoundException;
+use OCP\Security\Signature\IIncomingSignedRequest;
+use OCP\Security\Signature\ISignatureManager;
+use OCP\Security\Signature\Model\Signatory;
 use ValueError;
 
 /**
diff --git a/lib/private/Security/Signature/Model/OutgoingSignedRequest.php b/lib/private/Security/Signature/Model/OutgoingSignedRequest.php
index dbfac3bfd34e1..1cba76e45ceea 100644
--- a/lib/private/Security/Signature/Model/OutgoingSignedRequest.php
+++ b/lib/private/Security/Signature/Model/OutgoingSignedRequest.php
@@ -9,14 +9,14 @@
 namespace OC\Security\Signature\Model;
 
 use JsonSerializable;
-use NCU\Security\Signature\Enum\DigestAlgorithm;
-use NCU\Security\Signature\Enum\SignatureAlgorithm;
-use NCU\Security\Signature\Exceptions\SignatoryException;
-use NCU\Security\Signature\Exceptions\SignatoryNotFoundException;
-use NCU\Security\Signature\IOutgoingSignedRequest;
-use NCU\Security\Signature\ISignatoryManager;
-use NCU\Security\Signature\ISignatureManager;
 use OC\Security\Signature\SignatureManager;
+use OCP\Security\Signature\Enum\DigestAlgorithm;
+use OCP\Security\Signature\Enum\SignatureAlgorithm;
+use OCP\Security\Signature\Exceptions\SignatoryException;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\IOutgoingSignedRequest;
+use OCP\Security\Signature\ISignatoryManager;
+use OCP\Security\Signature\ISignatureManager;
 
 /**
  * extends ISignedRequest to add info requested at the generation of the signature
diff --git a/lib/private/Security/Signature/Model/SignedRequest.php b/lib/private/Security/Signature/Model/SignedRequest.php
index 12a43f32bcc37..7fe7149da2ba4 100644
--- a/lib/private/Security/Signature/Model/SignedRequest.php
+++ b/lib/private/Security/Signature/Model/SignedRequest.php
@@ -9,11 +9,11 @@
 namespace OC\Security\Signature\Model;
 
 use JsonSerializable;
-use NCU\Security\Signature\Enum\DigestAlgorithm;
-use NCU\Security\Signature\Exceptions\SignatoryNotFoundException;
-use NCU\Security\Signature\Exceptions\SignatureElementNotFoundException;
-use NCU\Security\Signature\ISignedRequest;
-use NCU\Security\Signature\Model\Signatory;
+use OCP\Security\Signature\Enum\DigestAlgorithm;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureElementNotFoundException;
+use OCP\Security\Signature\ISignedRequest;
+use OCP\Security\Signature\Model\Signatory;
 
 /**
  * @inheritDoc
diff --git a/lib/private/Security/Signature/SignatureManager.php b/lib/private/Security/Signature/SignatureManager.php
index 91a06e29b4a82..0c5bfdcc3ae9a 100644
--- a/lib/private/Security/Signature/SignatureManager.php
+++ b/lib/private/Security/Signature/SignatureManager.php
@@ -8,28 +8,28 @@
 
 namespace OC\Security\Signature;
 
-use NCU\Security\Signature\Enum\SignatoryType;
-use NCU\Security\Signature\Exceptions\IdentityNotFoundException;
-use NCU\Security\Signature\Exceptions\IncomingRequestException;
-use NCU\Security\Signature\Exceptions\InvalidKeyOriginException;
-use NCU\Security\Signature\Exceptions\InvalidSignatureException;
-use NCU\Security\Signature\Exceptions\SignatoryConflictException;
-use NCU\Security\Signature\Exceptions\SignatoryException;
-use NCU\Security\Signature\Exceptions\SignatoryNotFoundException;
-use NCU\Security\Signature\Exceptions\SignatureElementNotFoundException;
-use NCU\Security\Signature\Exceptions\SignatureException;
-use NCU\Security\Signature\Exceptions\SignatureNotFoundException;
-use NCU\Security\Signature\IIncomingSignedRequest;
-use NCU\Security\Signature\IOutgoingSignedRequest;
-use NCU\Security\Signature\ISignatoryManager;
-use NCU\Security\Signature\ISignatureManager;
-use NCU\Security\Signature\Model\Signatory;
 use OC\Security\Signature\Db\SignatoryMapper;
 use OC\Security\Signature\Model\IncomingSignedRequest;
 use OC\Security\Signature\Model\OutgoingSignedRequest;
 use OCP\DB\Exception as DBException;
 use OCP\IAppConfig;
 use OCP\IRequest;
+use OCP\Security\Signature\Enum\SignatoryType;
+use OCP\Security\Signature\Exceptions\IdentityNotFoundException;
+use OCP\Security\Signature\Exceptions\IncomingRequestException;
+use OCP\Security\Signature\Exceptions\InvalidKeyOriginException;
+use OCP\Security\Signature\Exceptions\InvalidSignatureException;
+use OCP\Security\Signature\Exceptions\SignatoryConflictException;
+use OCP\Security\Signature\Exceptions\SignatoryException;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureElementNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureException;
+use OCP\Security\Signature\Exceptions\SignatureNotFoundException;
+use OCP\Security\Signature\IIncomingSignedRequest;
+use OCP\Security\Signature\IOutgoingSignedRequest;
+use OCP\Security\Signature\ISignatoryManager;
+use OCP\Security\Signature\ISignatureManager;
+use OCP\Security\Signature\Model\Signatory;
 use Psr\Log\LoggerInterface;
 
 /**
diff --git a/lib/private/Server.php b/lib/private/Server.php
index a4fd45491846f..04db3eea842f5 100644
--- a/lib/private/Server.php
+++ b/lib/private/Server.php
@@ -8,7 +8,6 @@
 namespace OC;
 
 use bantu\IniGetWrapper\IniGetWrapper;
-use NCU\Security\Signature\ISignatureManager;
 use OC\Accounts\AccountManager;
 use OC\App\AppManager;
 use OC\App\AppStore\Bundles\BundleFetcher;
@@ -223,6 +222,7 @@
 use OCP\Security\ISecureRandom;
 use OCP\Security\ITrustedDomainHelper;
 use OCP\Security\RateLimiting\ILimiter;
+use OCP\Security\Signature\ISignatureManager;
 use OCP\Security\VerificationToken\IVerificationToken;
 use OCP\ServerVersion;
 use OCP\Settings\IDeclarativeManager;
diff --git a/lib/public/Federation/ISignedCloudFederationProvider.php b/lib/public/Federation/ISignedCloudFederationProvider.php
new file mode 100644
index 0000000000000..80682d3d8ad78
--- /dev/null
+++ b/lib/public/Federation/ISignedCloudFederationProvider.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2018 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCP\Federation;
+
+/**
+ * Interface ICloudFederationProvider
+ *
+ * Enable apps to create their own cloud federation provider
+ *
+ * @since 33.0.0
+ */
+interface ISignedCloudFederationProvider extends ICloudFederationProvider {
+
+	/**
+	 * returns federationId in direct relation (as recipient or as author) of a sharedSecret
+	 * the federationId must be the one at the remote end
+	 *
+	 * @param string $sharedSecret
+	 * @param array $payload
+	 *
+	 * @since 31.0.0
+	 * @return string
+	 */
+	public function getFederationIdFromSharedSecret(string $sharedSecret, array $payload): string;
+}
diff --git a/lib/public/OCM/IOCMDiscoveryService.php b/lib/public/OCM/IOCMDiscoveryService.php
index a53d93295da03..3f521224442a2 100644
--- a/lib/public/OCM/IOCMDiscoveryService.php
+++ b/lib/public/OCM/IOCMDiscoveryService.php
@@ -9,14 +9,14 @@
 
 namespace OCP\OCM;
 
-use NCU\Security\Signature\Exceptions\IncomingRequestException;
-use NCU\Security\Signature\IIncomingSignedRequest;
 use OCP\AppFramework\Attribute\Consumable;
 use OCP\Http\Client\IClient;
 use OCP\Http\Client\IResponse;
 use OCP\OCM\Events\LocalOCMDiscoveryEvent;
 use OCP\OCM\Exceptions\OCMCapabilityException;
 use OCP\OCM\Exceptions\OCMProviderException;
+use OCP\Security\Signature\Exceptions\IncomingRequestException;
+use OCP\Security\Signature\IIncomingSignedRequest;
 
 /**
  * Discover remote OCM services
diff --git a/lib/public/Security/Signature/Enum/DigestAlgorithm.php b/lib/public/Security/Signature/Enum/DigestAlgorithm.php
new file mode 100644
index 0000000000000..2fdceaa8c01ae
--- /dev/null
+++ b/lib/public/Security/Signature/Enum/DigestAlgorithm.php
@@ -0,0 +1,37 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2018 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Enum;
+
+use OCP\AppFramework\Attribute\Consumable;
+
+/**
+ * list of available algorithm when generating digest from body
+ *
+ * @since 33.0.0
+ */
+#[Consumable(since: '33.0.0')]
+enum DigestAlgorithm: string {
+	/** @since 33.0.0 */
+	case SHA256 = 'SHA-256';
+	/** @since 33.0.0 */
+	case SHA512 = 'SHA-512';
+
+	/**
+	 * returns hashing algorithm to be used when generating digest
+	 *
+	 * @return string
+	 * @since 33.0.0
+	 */
+	public function getHashingAlgorithm(): string {
+		return match($this) {
+			self::SHA256 => 'sha256',
+			self::SHA512 => 'sha512',
+		};
+	}
+}
diff --git a/lib/public/Security/Signature/Enum/SignatoryStatus.php b/lib/public/Security/Signature/Enum/SignatoryStatus.php
new file mode 100644
index 0000000000000..f62b5aeec5b27
--- /dev/null
+++ b/lib/public/Security/Signature/Enum/SignatoryStatus.php
@@ -0,0 +1,27 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Enum;
+
+use OCP\AppFramework\Attribute\Consumable;
+
+/**
+ * current status of signatory. is it trustable or not ?
+ *
+ * - SYNCED = the remote instance is trustable.
+ * - BROKEN = the remote instance does not use the same key pairs than previously
+ *
+ * @since 33.0.0
+ */
+#[Consumable(since: '33.0.0')]
+enum SignatoryStatus: int {
+	/** @since 33.0.0 */
+	case SYNCED = 1;
+	/** @since 33.0.0 */
+	case BROKEN = 9;
+}
diff --git a/lib/public/Security/Signature/Enum/SignatoryType.php b/lib/public/Security/Signature/Enum/SignatoryType.php
new file mode 100644
index 0000000000000..425bdc3d92ff2
--- /dev/null
+++ b/lib/public/Security/Signature/Enum/SignatoryType.php
@@ -0,0 +1,33 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Enum;
+
+use OCP\AppFramework\Attribute\Consumable;
+
+/**
+ * type of link between local and remote instance
+ *
+ * - FORGIVABLE = the keypair can be deleted and refreshed anytime; silently
+ * - REFRESHABLE = the keypair can be refreshed but a notice will be generated
+ * - TRUSTED = any changes of keypair will require human interaction, warning will be issued
+ * - STATIC = error will be issued on conflict,  assume keypair cannot be reset.
+ *
+ * @since 33.0.0
+ */
+#[Consumable(since: '33.0.0')]
+enum SignatoryType: int {
+	/** @since 33.0.0 */
+	case FORGIVABLE = 1; // no notice on refresh
+	/** @since 33.0.0 */
+	case REFRESHABLE = 4; // notice on refresh
+	/** @since 33.0.0 */
+	case TRUSTED = 8; // warning on refresh
+	/** @since 33.0.0 */
+	case STATIC = 9; // error on refresh
+}
diff --git a/lib/public/Security/Signature/Enum/SignatureAlgorithm.php b/lib/public/Security/Signature/Enum/SignatureAlgorithm.php
new file mode 100644
index 0000000000000..356fae1306223
--- /dev/null
+++ b/lib/public/Security/Signature/Enum/SignatureAlgorithm.php
@@ -0,0 +1,24 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2018 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Enum;
+
+use OCP\AppFramework\Attribute\Consumable;
+
+/**
+ * list of available algorithm when signing payload
+ *
+ * @since 33.0.0
+ */
+#[Consumable(since: '33.0.0')]
+enum SignatureAlgorithm: string {
+	/** @since 33.0.0 */
+	case RSA_SHA256 = 'rsa-sha256';
+	/** @since 33.0.0 */
+	case RSA_SHA512 = 'rsa-sha512';
+}
diff --git a/lib/public/Security/Signature/Exceptions/IdentityNotFoundException.php b/lib/public/Security/Signature/Exceptions/IdentityNotFoundException.php
new file mode 100644
index 0000000000000..47ff10361bf4b
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/IdentityNotFoundException.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCP\Security\Signature\Exceptions;
+
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class IdentityNotFoundException extends SignatureException {
+}
diff --git a/lib/public/Security/Signature/Exceptions/IncomingRequestException.php b/lib/public/Security/Signature/Exceptions/IncomingRequestException.php
new file mode 100644
index 0000000000000..7e1fb8700c127
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/IncomingRequestException.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Exceptions;
+
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class IncomingRequestException extends SignatureException {
+}
diff --git a/lib/public/Security/Signature/Exceptions/InvalidKeyOriginException.php b/lib/public/Security/Signature/Exceptions/InvalidKeyOriginException.php
new file mode 100644
index 0000000000000..106d3e8fa6af8
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/InvalidKeyOriginException.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Exceptions;
+
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class InvalidKeyOriginException extends SignatureException {
+}
diff --git a/lib/public/Security/Signature/Exceptions/InvalidSignatureException.php b/lib/public/Security/Signature/Exceptions/InvalidSignatureException.php
new file mode 100644
index 0000000000000..035d1b790df88
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/InvalidSignatureException.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Exceptions;
+
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class InvalidSignatureException extends SignatureException {
+}
diff --git a/lib/public/Security/Signature/Exceptions/SignatoryConflictException.php b/lib/public/Security/Signature/Exceptions/SignatoryConflictException.php
new file mode 100644
index 0000000000000..48393edb909a2
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/SignatoryConflictException.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCP\Security\Signature\Exceptions;
+
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class SignatoryConflictException extends SignatoryException {
+}
diff --git a/lib/public/Security/Signature/Exceptions/SignatoryException.php b/lib/public/Security/Signature/Exceptions/SignatoryException.php
new file mode 100644
index 0000000000000..ccc4d3f9d1c6e
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/SignatoryException.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCP\Security\Signature\Exceptions;
+
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class SignatoryException extends SignatureException {
+}
diff --git a/lib/public/Security/Signature/Exceptions/SignatoryNotFoundException.php b/lib/public/Security/Signature/Exceptions/SignatoryNotFoundException.php
new file mode 100644
index 0000000000000..b2b43de906496
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/SignatoryNotFoundException.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCP\Security\Signature\Exceptions;
+
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class SignatoryNotFoundException extends SignatoryException {
+}
diff --git a/lib/public/Security/Signature/Exceptions/SignatureElementNotFoundException.php b/lib/public/Security/Signature/Exceptions/SignatureElementNotFoundException.php
new file mode 100644
index 0000000000000..71bf97b8dc1be
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/SignatureElementNotFoundException.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Exceptions;
+
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class SignatureElementNotFoundException extends SignatureException {
+}
diff --git a/lib/public/Security/Signature/Exceptions/SignatureException.php b/lib/public/Security/Signature/Exceptions/SignatureException.php
new file mode 100644
index 0000000000000..466729eabc9ad
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/SignatureException.php
@@ -0,0 +1,19 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCP\Security\Signature\Exceptions;
+
+use Exception;
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class SignatureException extends Exception {
+}
diff --git a/lib/public/Security/Signature/Exceptions/SignatureNotFoundException.php b/lib/public/Security/Signature/Exceptions/SignatureNotFoundException.php
new file mode 100644
index 0000000000000..c7a05f6e48e5c
--- /dev/null
+++ b/lib/public/Security/Signature/Exceptions/SignatureNotFoundException.php
@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2023 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Exceptions;
+
+use OCP\AppFramework\Attribute\Throwable;
+
+/**
+ * @since 33.0.0
+ */
+#[Throwable(since: '33.0.0')]
+class SignatureNotFoundException extends SignatureException {
+}
diff --git a/lib/public/Security/Signature/IIncomingSignedRequest.php b/lib/public/Security/Signature/IIncomingSignedRequest.php
new file mode 100644
index 0000000000000..ab25816eb82d3
--- /dev/null
+++ b/lib/public/Security/Signature/IIncomingSignedRequest.php
@@ -0,0 +1,68 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature;
+
+use OCP\AppFramework\Attribute\Consumable;
+use OCP\IRequest;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureElementNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureException;
+
+/**
+ * model wrapping an actual incoming request, adding details about the signature and the
+ * authenticity of the origin of the request.
+ *
+ * This interface must not be implemented in your application but
+ * instead obtained from {@see ISignatureManager::getIncomingSignedRequest}.
+ *
+ *  ```php
+ *  $signedRequest = $this->signatureManager->getIncomingSignedRequest($mySignatoryManager);
+ *  ```
+ *
+ * @see ISignatureManager for details on signature
+ * @since 33.0.0
+ */
+#[Consumable(since: '33.0.0')]
+interface IIncomingSignedRequest extends ISignedRequest {
+	/**
+	 * returns the base IRequest
+	 *
+	 * @return IRequest
+	 * @since 33.0.0
+	 */
+	public function getRequest(): IRequest;
+
+	/**
+	 * get the hostname at the source of the base request.
+	 * based on the keyId defined in the signature header.
+	 *
+	 * @return string
+	 * @since 33.0.0
+	 */
+	public function getOrigin(): string;
+
+	/**
+	 * returns the keyId extracted from the signature headers.
+	 * keyId is a mandatory entry in the headers of a signed request.
+	 *
+	 * @return string
+	 * @throws SignatureElementNotFoundException
+	 * @since 33.0.0
+	 */
+	public function getKeyId(): string;
+
+	/**
+	 * confirm the current signed request's identity is correct
+	 *
+	 * @throws SignatureException
+	 * @throws SignatoryNotFoundException
+	 * @since 33.0.0
+	 */
+	public function verify(): void;
+}
diff --git a/lib/public/Security/Signature/IOutgoingSignedRequest.php b/lib/public/Security/Signature/IOutgoingSignedRequest.php
new file mode 100644
index 0000000000000..df8dc8a0de271
--- /dev/null
+++ b/lib/public/Security/Signature/IOutgoingSignedRequest.php
@@ -0,0 +1,114 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature;
+
+use OCP\AppFramework\Attribute\Consumable;
+use OCP\Security\Signature\Enum\SignatureAlgorithm;
+use OCP\Security\Signature\Exceptions\SignatoryException;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+
+/**
+ * extends ISignedRequest to add info requested at the generation of the signature
+ *
+ *  This interface must not be implemented in your application but
+ *  instead obtained from {@see ISignatureManager::getIncomingSignedRequest}.
+ *
+ *   ```php
+ *   $signedRequest = $this->signatureManager->getIncomingSignedRequest($mySignatoryManager);
+ *   ```
+ *
+ * @see ISignatureManager for details on signature
+ * @since 33.0.0
+ */
+#[Consumable(since: '33.0.0')]
+interface IOutgoingSignedRequest extends ISignedRequest {
+	/**
+	 * set the host of the recipient of the request.
+	 *
+	 * @param string $host
+	 * @return self
+	 * @since 33.0.0
+	 */
+	public function setHost(string $host): self;
+
+	/**
+	 * get the host of the recipient of the request.
+	 * - on incoming request, this is the local hostname of current instance.
+	 * - on outgoing request, this is the remote instance.
+	 *
+	 * @return string
+	 * @since 33.0.0
+	 */
+	public function getHost(): string;
+
+	/**
+	 * add a key/value pair to the headers of the request
+	 *
+	 * @param string $key
+	 * @param string|int|float $value
+	 *
+	 * @return self
+	 * @since 33.0.0
+	 */
+	public function addHeader(string $key, string|int|float $value): self;
+
+	/**
+	 * returns list of headers value that will be added to the base request
+	 *
+	 * @return array
+	 * @since 33.0.0
+	 */
+	public function getHeaders(): array;
+
+	/**
+	 * set the ordered list of used headers in the Signature
+	 *
+	 * @param list<string> $list
+	 *
+	 * @return self
+	 * @since 33.0.0
+	 */
+	public function setHeaderList(array $list): self;
+
+	/**
+	 * returns ordered list of used headers in the Signature
+	 *
+	 * @return list<string>
+	 * @since 33.0.0
+	 */
+	public function getHeaderList(): array;
+
+	/**
+	 * set algorithm to be used to sign the signature
+	 *
+	 * @param SignatureAlgorithm $algorithm
+	 *
+	 * @return self
+	 * @since 33.0.0
+	 */
+	public function setAlgorithm(SignatureAlgorithm $algorithm): self;
+
+	/**
+	 * returns the algorithm set to sign the signature
+	 *
+	 * @return SignatureAlgorithm
+	 * @since 33.0.0
+	 */
+	public function getAlgorithm(): SignatureAlgorithm;
+
+	/**
+	 * sign outgoing request providing a certificate that it emanate from this instance
+	 *
+	 * @return self
+	 * @throws SignatoryException
+	 * @throws SignatoryNotFoundException
+	 * @since 33.0.0
+	 */
+	public function sign(): self;
+}
diff --git a/lib/public/Security/Signature/ISignatoryManager.php b/lib/public/Security/Signature/ISignatoryManager.php
new file mode 100644
index 0000000000000..771ce669b65f3
--- /dev/null
+++ b/lib/public/Security/Signature/ISignatoryManager.php
@@ -0,0 +1,75 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature;
+
+use OCP\AppFramework\Attribute\Consumable;
+use OCP\Security\Signature\Model\Signatory;
+
+/**
+ * ISignatoryManager contains a group of method that will help
+ *   - signing outgoing request
+ *   - confirm the authenticity of incoming signed request.
+ *
+ * This interface must be implemented to generate a `SignatoryManager` to
+ *  be used with {@see ISignatureManager}
+ *
+ * @since 33.0.0
+ */
+#[Consumable(since: '33.0.0')]
+interface ISignatoryManager {
+	/**
+	 * id of the signatory manager.
+	 * This is used to store, confirm uniqueness and avoid conflict of the remote key pairs.
+	 *
+	 * Must be unique.
+	 *
+	 * @return string
+	 * @since 33.0.0
+	 */
+	public function getProviderId(): string;
+
+	/**
+	 * options that might affect the way the whole process is handled:
+	 * [
+	 *   'bodyMaxSize' => 10000,
+	 *   'ttl' => 300,
+	 *   'ttlSignatory' => 86400*3,
+	 *   'extraSignatureHeaders' => [],
+	 *   'algorithm' => 'sha256',
+	 *   'dateHeader' => "D, d M Y H:i:s T",
+	 * ]
+	 *
+	 * @return array
+	 * @since 33.0.0
+	 */
+	public function getOptions(): array;
+
+	/**
+	 * generate and returns local signatory including private and public key pair.
+	 *
+	 * Used to sign outgoing request
+	 *
+	 * @return Signatory
+	 * @since 33.0.0
+	 */
+	public function getLocalSignatory(): Signatory;
+
+	/**
+	 * retrieve details and generate signatory from remote instance.
+	 * If signatory cannot be found, returns NULL.
+	 *
+	 * Used to confirm authenticity of incoming request.
+	 *
+	 * @param string $remote
+	 *
+	 * @return Signatory|null must be NULL if no signatory is found
+	 * @since 33.0.0
+	 */
+	public function getRemoteSignatory(string $remote): ?Signatory;
+}
diff --git a/lib/public/Security/Signature/ISignatureManager.php b/lib/public/Security/Signature/ISignatureManager.php
new file mode 100644
index 0000000000000..c5238e314c894
--- /dev/null
+++ b/lib/public/Security/Signature/ISignatureManager.php
@@ -0,0 +1,138 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature;
+
+use OCP\AppFramework\Attribute\Consumable;
+use OCP\Security\Signature\Exceptions\IdentityNotFoundException;
+use OCP\Security\Signature\Exceptions\IncomingRequestException;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureException;
+use OCP\Security\Signature\Exceptions\SignatureNotFoundException;
+use OCP\Security\Signature\Model\Signatory;
+
+/**
+ * ISignatureManager is a service integrated to core that provide tools
+ * to set/get authenticity of/from outgoing/incoming request.
+ *
+ * Quick description of the signature, added to the headers
+ * {
+ *     "(request-target)": "post /path",
+ *     "content-length": 385,
+ *     "date": "Mon, 08 Jul 2024 14:16:20 GMT",
+ *     "digest": "SHA-256=U7gNVUQiixe5BRbp4Tg0xCZMTcSWXXUZI2\\/xtHM40S0=",
+ *     "host": "hostname.of.the.recipient",
+ *     "Signature": "keyId=\"https://author.hostname/key\",algorithm=\"sha256\",headers=\"content-length date digest host\",signature=\"DzN12OCS1rsA[...]o0VmxjQooRo6HHabg==\""
+ * }
+ *
+ * 'content-length' is the total length of the data/content
+ * 'date' is the datetime the request have been initiated
+ * 'digest' is a checksum of the data/content
+ * 'host' is the hostname of the recipient of the request (remote when signing outgoing request, local on incoming request)
+ * 'Signature' contains the signature generated using the private key, and metadata:
+ *    - 'keyId' is a unique id, formatted as an url. hostname is used to retrieve the public key via custom discovery
+ *    - 'algorithm' define the algorithm used to generate signature
+ *    - 'headers' contains a list of element used during the generation of the signature
+ *    - 'signature' is the encrypted string, using local private key, of an array containing elements
+ *      listed in 'headers' and their value. Some elements (content-length date digest host) are mandatory
+ *      to ensure authenticity override protection.
+ *
+ * This interface can be used to inject {@see SignatureManager} in your code:
+ *
+ * ```php
+ *    public function __construct(
+ *        private ISignatureManager $signatureManager,
+ *    ) {}
+ *  ```
+ *
+ *   instead obtained from {@see ISignatureManager::getIncomingSignedRequest}.
+ *
+ * @since 33.0.0
+ */
+#[Consumable(since: '33.0.0')]
+interface ISignatureManager {
+	/**
+	 * Extracting data from headers and body from the incoming request.
+	 * Compare headers and body to confirm authenticity of remote instance.
+	 * Returns details about the signed request or throws exception.
+	 *
+	 * Should be called from Controller.
+	 *
+	 * @param ISignatoryManager $signatoryManager used to get details about remote instance
+	 * @param string|null $body if NULL, body will be extracted from php://input
+	 *
+	 * @return IIncomingSignedRequest
+	 * @throws IncomingRequestException if anything looks wrong with the incoming request
+	 * @throws SignatureNotFoundException if incoming request is not signed
+	 * @throws SignatureException if signature could not be confirmed
+	 * @since 33.0.0
+	 */
+	public function getIncomingSignedRequest(ISignatoryManager $signatoryManager, ?string $body = null): IIncomingSignedRequest;
+
+	/**
+	 * Preparing signature (and headers) to sign an outgoing request.
+	 * Returns a IOutgoingSignedRequest containing all details to finalise the packaging of the whole payload
+	 *
+	 * @param ISignatoryManager $signatoryManager
+	 * @param string $content body to be signed
+	 * @param string $method needed in the signature
+	 * @param string $uri needed in the signature
+	 *
+	 * @return IOutgoingSignedRequest
+	 * @since 33.0.0
+	 */
+	public function getOutgoingSignedRequest(ISignatoryManager $signatoryManager, string $content, string $method, string $uri): IOutgoingSignedRequest;
+
+	/**
+	 * Complete the full process of signing and filling headers from payload when generating
+	 * an outgoing request with IClient
+	 *
+	 * @param ISignatoryManager $signatoryManager
+	 * @param array $payload original payload, will be used to sign and completed with new headers with signature elements
+	 * @param string $method needed in the signature
+	 * @param string $uri needed in the signature
+	 *
+	 * @return array new payload to be sent, including original payload and signature elements in headers
+	 * @since 33.0.0
+	 */
+	public function signOutgoingRequestIClientPayload(ISignatoryManager $signatoryManager, array $payload, string $method, string $uri): array;
+
+	/**
+	 * returns remote signatory stored in local database, based on the remote host.
+	 *
+	 * @param string $host remote host
+	 * @param string $account linked account, should be used when multiple signature can exist for the same host
+	 *
+	 * @return Signatory
+	 * @throws SignatoryNotFoundException if entry does not exist in local database
+	 * @since 33.0.0
+	 */
+	public function getSignatory(string $host, string $account = ''): Signatory;
+
+	/**
+	 * returns a fully formatted keyId, based on a fix hostname and path
+	 *
+	 * @param string $path
+	 *
+	 * @return string
+	 * @throws IdentityNotFoundException if hostname is not set
+	 * @since 33.0.0
+	 */
+	public function generateKeyIdFromConfig(string $path): string;
+
+	/**
+	 * returns hostname:port extracted from an uri
+	 *
+	 * @param string $uri
+	 *
+	 * @return string
+	 * @throws IdentityNotFoundException if identity cannot be extracted
+	 * @since 33.0.0
+	 */
+	public function extractIdentityFromUri(string $uri): string;
+}
diff --git a/lib/public/Security/Signature/ISignedRequest.php b/lib/public/Security/Signature/ISignedRequest.php
new file mode 100644
index 0000000000000..94f5f13b5e2d2
--- /dev/null
+++ b/lib/public/Security/Signature/ISignedRequest.php
@@ -0,0 +1,123 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature;
+
+use OCP\AppFramework\Attribute\Consumable;
+use OCP\Security\Signature\Enum\DigestAlgorithm;
+use OCP\Security\Signature\Exceptions\SignatoryNotFoundException;
+use OCP\Security\Signature\Exceptions\SignatureElementNotFoundException;
+use OCP\Security\Signature\Model\Signatory;
+
+/**
+ * model that store data related to a possible signature.
+ * those details will be used:
+ * - to confirm authenticity of a signed incoming request
+ * - to sign an outgoing request
+ *
+ * This interface must not be implemented in your application:
+ * @see IIncomingSignedRequest
+ * @see IOutgoingSignedRequest
+ *
+ * @since 33.0.0
+ */
+#[Consumable(since: '33.0.0')]
+interface ISignedRequest {
+	/**
+	 * payload of the request
+	 *
+	 * @return string
+	 * @since 33.0.0
+	 */
+	public function getBody(): string;
+
+	/**
+	 * get algorithm used to generate digest
+	 *
+	 * @return DigestAlgorithm
+	 * @since 33.0.0
+	 */
+	public function getDigestAlgorithm(): DigestAlgorithm;
+
+	/**
+	 * checksum of the payload of the request
+	 *
+	 * @return string
+	 * @since 33.0.0
+	 */
+	public function getDigest(): string;
+
+	/**
+	 * set the list of headers related to the signature of the request
+	 *
+	 * @param array $elements
+	 *
+	 * @return self
+	 * @since 33.0.0
+	 */
+	public function setSigningElements(array $elements): self;
+
+	/**
+	 * get the list of elements in the Signature header of the request
+	 *
+	 * @return array
+	 * @since 33.0.0
+	 */
+	public function getSigningElements(): array;
+
+	/**
+	 * @param string $key
+	 *
+	 * @return string
+	 * @throws SignatureElementNotFoundException
+	 * @since 33.0.0
+	 */
+	public function getSigningElement(string $key): string;
+
+	/**
+	 * returns data used to generate signature
+	 *
+	 * @return array
+	 * @since 33.0.0
+	 */
+	public function getSignatureData(): array;
+
+	/**
+	 * get the signed version of the signature
+	 *
+	 * @return string
+	 * @since 33.0.0
+	 */
+	public function getSignature(): string;
+
+	/**
+	 * set the signatory, containing keys and details, related to this request
+	 *
+	 * @param Signatory $signatory
+	 * @return self
+	 * @since 33.0.0
+	 */
+	public function setSignatory(Signatory $signatory): self;
+
+	/**
+	 * get the signatory, containing keys and details, related to this request
+	 *
+	 * @return Signatory
+	 * @throws SignatoryNotFoundException
+	 * @since 33.0.0
+	 */
+	public function getSignatory(): Signatory;
+
+	/**
+	 * returns if a signatory related to this request have been found and defined
+	 *
+	 * @return bool
+	 * @since 33.0.0
+	 */
+	public function hasSignatory(): bool;
+}
diff --git a/lib/public/Security/Signature/Model/Signatory.php b/lib/public/Security/Signature/Model/Signatory.php
new file mode 100644
index 0000000000000..6ab1133c229fe
--- /dev/null
+++ b/lib/public/Security/Signature/Model/Signatory.php
@@ -0,0 +1,202 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OCP\Security\Signature\Model;
+
+use JsonSerializable;
+use OCP\AppFramework\Attribute\Consumable;
+use OCP\AppFramework\Db\Entity;
+use OCP\Security\Signature\Enum\SignatoryStatus;
+use OCP\Security\Signature\Enum\SignatoryType;
+use OCP\Security\Signature\Exceptions\IdentityNotFoundException;
+
+/**
+ * model that store keys and details related to host and in use protocol
+ * mandatory details are providerId, host, keyId and public key.
+ * private key is only used for local signatory, used to sign outgoing request
+ *
+ * the pair providerId+host is unique, meaning only one signatory can exist for each host
+ * and protocol
+ *
+ * @since 33.0.0
+ *
+ * @method void setProviderId(string $providerId)
+ * @method string getProviderId()
+ * @method string getKeyId()
+ * @method void setKeyIdSum(string $keyIdSum)
+ * @method string getKeyIdSum()
+ * @method void setPublicKey(string $publicKey)
+ * @method string getPublicKey()
+ * @method void setPrivateKey(string $privateKey)
+ * @method string getPrivateKey()
+ * @method void setHost(string $host)
+ * @method string getHost()
+ * @method int getType()
+ * @method void setType(int $type)
+ * @method int getStatus()
+ * @method void setStatus(int $status)
+ * @method void setAccount(?string $account)
+ * @method void setMetadata(array $metadata)
+ * @method ?array getMetadata()
+ * @method void setCreation(int $creation)
+ * @method int getCreation()
+ * @method void setLastUpdated(int $creation)
+ * @method int getLastUpdated()
+ * @psalm-suppress PropertyNotSetInConstructor
+ */
+#[Consumable(since: '33.0.0')]
+class Signatory extends Entity implements JsonSerializable {
+	protected string $keyId = '';
+	protected string $keyIdSum = '';
+	protected string $providerId = '';
+	protected string $host = '';
+	protected string $publicKey = '';
+	protected string $privateKey = '';
+	protected ?string $account = '';
+	protected int $type = 9;
+	protected int $status = 1;
+	protected ?array $metadata = null;
+	protected int $creation = 0;
+	protected int $lastUpdated = 0;
+
+	/**
+	 * @param bool $local only set to TRUE when managing local signatory
+	 *
+	 * @since 33.0.0
+	 */
+	public function __construct(
+		private readonly bool $local = false,
+	) {
+		$this->addType('providerId', 'string');
+		$this->addType('host', 'string');
+		$this->addType('account', 'string');
+		$this->addType('keyId', 'string');
+		$this->addType('keyIdSum', 'string');
+		$this->addType('publicKey', 'string');
+		$this->addType('metadata', 'json');
+		$this->addType('type', 'integer');
+		$this->addType('status', 'integer');
+		$this->addType('creation', 'integer');
+		$this->addType('lastUpdated', 'integer');
+	}
+
+	/**
+	 * @param string $keyId
+	 *
+	 * @since 33.0.0
+	 * @throws IdentityNotFoundException if identity cannot be extracted from keyId
+	 */
+	public function setKeyId(string $keyId): void {
+		// if set as local (for current instance), we apply some filters.
+		if ($this->local) {
+			// to avoid conflict with duplicate key pairs (ie generated url from the occ command), we enforce https as prefix
+			if (str_starts_with($keyId, 'http://')) {
+				$keyId = 'https://' . substr($keyId, 7);
+			}
+
+			// removing /index.php from generated url
+			$path = parse_url($keyId, PHP_URL_PATH);
+			if (str_starts_with($path, '/index.php/')) {
+				$pos = strpos($keyId, '/index.php');
+				if ($pos !== false) {
+					$keyId = substr_replace($keyId, '', $pos, 10);
+				}
+			}
+		}
+		$this->setter('keyId', [$keyId]); // needed to trigger the update in database
+		$this->setKeyIdSum(hash('sha256', $keyId));
+
+		$this->setHost(self::extractIdentityFromUri($this->getKeyId()));
+	}
+
+	/**
+	 * @param SignatoryType $type
+	 * @since 33.0.0
+	 */
+	public function setSignatoryType(SignatoryType $type): void {
+		$this->setType($type->value);
+	}
+
+	/**
+	 * @return SignatoryType
+	 * @since 33.0.0
+	 */
+	public function getSignatoryType(): SignatoryType {
+		return SignatoryType::from($this->getType());
+	}
+
+	/**
+	 * @param SignatoryStatus $status
+	 * @since 33.0.0
+	 */
+	public function setSignatoryStatus(SignatoryStatus $status): void {
+		$this->setStatus($status->value);
+	}
+
+	/**
+	 * @return SignatoryStatus
+	 * @since 33.0.0
+	 */
+	public function getSignatoryStatus(): SignatoryStatus {
+		return SignatoryStatus::from($this->getStatus());
+	}
+
+	/**
+	 * @since 33.0.0
+	 */
+	public function getAccount(): string {
+		return $this->account ?? '';
+	}
+
+	/**
+	 * update an entry in metadata
+	 *
+	 * @param string $key
+	 * @param string|int|float|bool|array $value
+	 * @since 33.0.0
+	 */
+	public function setMetaValue(string $key, string|int|float|bool|array $value): void {
+		$this->metadata[$key] = $value;
+		$this->setter('metadata', [$this->metadata]);
+	}
+
+	/**
+	 * @return array
+	 * @since 33.0.0
+	 */
+	public function jsonSerialize(): array {
+		return [
+			'keyId' => $this->getKeyId(),
+			'publicKeyPem' => $this->getPublicKey()
+		];
+	}
+
+	/**
+	 * static is needed to make this easily callable from outside the model
+	 *
+	 * @param string $uri
+	 *
+	 * @return string
+	 * @throws IdentityNotFoundException if identity cannot be extracted
+	 * @since 33.0.0
+	 */
+	public static function extractIdentityFromUri(string $uri): string {
+		$identity = parse_url($uri, PHP_URL_HOST);
+		$port = parse_url($uri, PHP_URL_PORT);
+		if ($identity === null || $identity === false) {
+			throw new IdentityNotFoundException('cannot extract identity from ' . $uri);
+		}
+
+		if ($port !== null && $port !== false) {
+			$identity .= ':' . $port;
+		}
+
+		return $identity;
+	}
+
+}
diff --git a/lib/unstable/Federation/ISignedCloudFederationProvider.php b/lib/unstable/Federation/ISignedCloudFederationProvider.php
index 1ec50f606aeab..c966be067fb7a 100644
--- a/lib/unstable/Federation/ISignedCloudFederationProvider.php
+++ b/lib/unstable/Federation/ISignedCloudFederationProvider.php
@@ -16,6 +16,7 @@
  * Enable apps to create their own cloud federation provider
  *
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Federation\ISignedCloudFederationProvider}
  */
 interface ISignedCloudFederationProvider extends ICloudFederationProvider {
 
@@ -27,6 +28,7 @@ interface ISignedCloudFederationProvider extends ICloudFederationProvider {
 	 * @param array $payload
 	 *
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Federation\ISignedCloudFederationProvider}
 	 * @return string
 	 */
 	public function getFederationIdFromSharedSecret(string $sharedSecret, array $payload): string;
diff --git a/lib/unstable/Security/Signature/Enum/DigestAlgorithm.php b/lib/unstable/Security/Signature/Enum/DigestAlgorithm.php
index 465f33fd2c355..f97de0f5d3942 100644
--- a/lib/unstable/Security/Signature/Enum/DigestAlgorithm.php
+++ b/lib/unstable/Security/Signature/Enum/DigestAlgorithm.php
@@ -12,11 +12,18 @@
  * list of available algorithm when generating digest from body
  *
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Enum\DigestAlgorithm}
  */
 enum DigestAlgorithm: string {
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case SHA256 = 'SHA-256';
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case SHA512 = 'SHA-512';
 
 	/**
@@ -24,6 +31,8 @@ enum DigestAlgorithm: string {
 	 *
 	 * @return string
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Enum\DigestAlgorithm}
+	 * @psalm-suppress DeprecatedConstant
 	 */
 	public function getHashingAlgorithm(): string {
 		return match($this) {
diff --git a/lib/unstable/Security/Signature/Enum/SignatoryStatus.php b/lib/unstable/Security/Signature/Enum/SignatoryStatus.php
index 1e460aed449fd..a46e5449cf06f 100644
--- a/lib/unstable/Security/Signature/Enum/SignatoryStatus.php
+++ b/lib/unstable/Security/Signature/Enum/SignatoryStatus.php
@@ -15,10 +15,17 @@
  * - BROKEN = the remote instance does not use the same key pairs than previously
  *
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Enum\SignatoryStatus}
  */
 enum SignatoryStatus: int {
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case SYNCED = 1;
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case BROKEN = 9;
 }
diff --git a/lib/unstable/Security/Signature/Enum/SignatoryType.php b/lib/unstable/Security/Signature/Enum/SignatoryType.php
index de3e556847909..c3bec63d79ad0 100644
--- a/lib/unstable/Security/Signature/Enum/SignatoryType.php
+++ b/lib/unstable/Security/Signature/Enum/SignatoryType.php
@@ -17,14 +17,27 @@
  * - STATIC = error will be issued on conflict,  assume keypair cannot be reset.
  *
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Enum\SignatoryType}
  */
 enum SignatoryType: int {
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case FORGIVABLE = 1; // no notice on refresh
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case REFRESHABLE = 4; // notice on refresh
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case TRUSTED = 8; // warning on refresh
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case STATIC = 9; // error on refresh
 }
diff --git a/lib/unstable/Security/Signature/Enum/SignatureAlgorithm.php b/lib/unstable/Security/Signature/Enum/SignatureAlgorithm.php
index 5afa8a3f81003..7614147bc70cb 100644
--- a/lib/unstable/Security/Signature/Enum/SignatureAlgorithm.php
+++ b/lib/unstable/Security/Signature/Enum/SignatureAlgorithm.php
@@ -12,10 +12,17 @@
  * list of available algorithm when signing payload
  *
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Enum\SignatureAlgorithm}
  */
 enum SignatureAlgorithm: string {
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case RSA_SHA256 = 'rsa-sha256';
-	/** @experimental 31.0.0 */
+	/**
+	 * @experimental 31.0.0
+	 * @deprecated 33.0.0
+	 */
 	case RSA_SHA512 = 'rsa-sha512';
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/IdentityNotFoundException.php b/lib/unstable/Security/Signature/Exceptions/IdentityNotFoundException.php
index c8c700033e623..4b37acd292bb6 100644
--- a/lib/unstable/Security/Signature/Exceptions/IdentityNotFoundException.php
+++ b/lib/unstable/Security/Signature/Exceptions/IdentityNotFoundException.php
@@ -10,6 +10,8 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\IdentityNotFoundException}
+ * @psalm-suppress DeprecatedClass
  */
 class IdentityNotFoundException extends SignatureException {
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/IncomingRequestException.php b/lib/unstable/Security/Signature/Exceptions/IncomingRequestException.php
index c334090fdc340..16e9209f7433a 100644
--- a/lib/unstable/Security/Signature/Exceptions/IncomingRequestException.php
+++ b/lib/unstable/Security/Signature/Exceptions/IncomingRequestException.php
@@ -10,6 +10,8 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\IncomingRequestException}
+ * @psalm-suppress DeprecatedClass
  */
 class IncomingRequestException extends SignatureException {
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/InvalidKeyOriginException.php b/lib/unstable/Security/Signature/Exceptions/InvalidKeyOriginException.php
index 3d8fa78077f8d..d7235ee1683f0 100644
--- a/lib/unstable/Security/Signature/Exceptions/InvalidKeyOriginException.php
+++ b/lib/unstable/Security/Signature/Exceptions/InvalidKeyOriginException.php
@@ -10,6 +10,8 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\InvalidKeyOriginException}
+ * @psalm-suppress DeprecatedClass
  */
 class InvalidKeyOriginException extends SignatureException {
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/InvalidSignatureException.php b/lib/unstable/Security/Signature/Exceptions/InvalidSignatureException.php
index 351637ef201b9..37430c74f2eb7 100644
--- a/lib/unstable/Security/Signature/Exceptions/InvalidSignatureException.php
+++ b/lib/unstable/Security/Signature/Exceptions/InvalidSignatureException.php
@@ -10,6 +10,8 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\InvalidSignatureException}
+ * @psalm-suppress DeprecatedClass
  */
 class InvalidSignatureException extends SignatureException {
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/SignatoryConflictException.php b/lib/unstable/Security/Signature/Exceptions/SignatoryConflictException.php
index e078071e970a1..dc53fe94726e1 100644
--- a/lib/unstable/Security/Signature/Exceptions/SignatoryConflictException.php
+++ b/lib/unstable/Security/Signature/Exceptions/SignatoryConflictException.php
@@ -10,6 +10,8 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\SignatoryConflictException}
+ * @psalm-suppress DeprecatedClass
  */
 class SignatoryConflictException extends SignatoryException {
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/SignatoryException.php b/lib/unstable/Security/Signature/Exceptions/SignatoryException.php
index 92409ab3d988b..12e505dcaeb4d 100644
--- a/lib/unstable/Security/Signature/Exceptions/SignatoryException.php
+++ b/lib/unstable/Security/Signature/Exceptions/SignatoryException.php
@@ -10,6 +10,8 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\SignatoryException}
+ * @psalm-suppress DeprecatedClass
  */
 class SignatoryException extends SignatureException {
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/SignatoryNotFoundException.php b/lib/unstable/Security/Signature/Exceptions/SignatoryNotFoundException.php
index 0234b3e7d5c8a..0b141d862c25f 100644
--- a/lib/unstable/Security/Signature/Exceptions/SignatoryNotFoundException.php
+++ b/lib/unstable/Security/Signature/Exceptions/SignatoryNotFoundException.php
@@ -10,6 +10,8 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\SignatoryNotFoundException}
+ * @psalm-suppress DeprecatedClass
  */
 class SignatoryNotFoundException extends SignatoryException {
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/SignatureElementNotFoundException.php b/lib/unstable/Security/Signature/Exceptions/SignatureElementNotFoundException.php
index ca0fa1c2194b2..8930bc0b7761d 100644
--- a/lib/unstable/Security/Signature/Exceptions/SignatureElementNotFoundException.php
+++ b/lib/unstable/Security/Signature/Exceptions/SignatureElementNotFoundException.php
@@ -10,6 +10,8 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\SignatureElementNotFoundException}
+ * @psalm-suppress DeprecatedClass
  */
 class SignatureElementNotFoundException extends SignatureException {
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/SignatureException.php b/lib/unstable/Security/Signature/Exceptions/SignatureException.php
index 12353a8e61b51..6cdd2d732bccb 100644
--- a/lib/unstable/Security/Signature/Exceptions/SignatureException.php
+++ b/lib/unstable/Security/Signature/Exceptions/SignatureException.php
@@ -12,6 +12,7 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\SignatureException}
  */
 class SignatureException extends Exception {
 }
diff --git a/lib/unstable/Security/Signature/Exceptions/SignatureNotFoundException.php b/lib/unstable/Security/Signature/Exceptions/SignatureNotFoundException.php
index f015b07673b1f..13c820ddf539e 100644
--- a/lib/unstable/Security/Signature/Exceptions/SignatureNotFoundException.php
+++ b/lib/unstable/Security/Signature/Exceptions/SignatureNotFoundException.php
@@ -10,6 +10,8 @@
 
 /**
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Exceptions\SignatureNotFoundException}
+ * @psalm-suppress DeprecatedClass
  */
 class SignatureNotFoundException extends SignatureException {
 }
diff --git a/lib/unstable/Security/Signature/IIncomingSignedRequest.php b/lib/unstable/Security/Signature/IIncomingSignedRequest.php
index 5c06c41c394eb..bed64ef140445 100644
--- a/lib/unstable/Security/Signature/IIncomingSignedRequest.php
+++ b/lib/unstable/Security/Signature/IIncomingSignedRequest.php
@@ -26,6 +26,7 @@
  *
  * @see ISignatureManager for details on signature
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IIncomingSignedRequest}
  */
 interface IIncomingSignedRequest extends ISignedRequest {
 	/**
@@ -33,6 +34,7 @@ interface IIncomingSignedRequest extends ISignedRequest {
 	 *
 	 * @return IRequest
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IIncomingSignedRequest}
 	 */
 	public function getRequest(): IRequest;
 
@@ -42,6 +44,7 @@ public function getRequest(): IRequest;
 	 *
 	 * @return string
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IIncomingSignedRequest}
 	 */
 	public function getOrigin(): string;
 
@@ -52,6 +55,7 @@ public function getOrigin(): string;
 	 * @return string
 	 * @throws SignatureElementNotFoundException
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IIncomingSignedRequest}
 	 */
 	public function getKeyId(): string;
 
@@ -61,6 +65,7 @@ public function getKeyId(): string;
 	 * @throws SignatureException
 	 * @throws SignatoryNotFoundException
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IIncomingSignedRequest}
 	 */
 	public function verify(): void;
 }
diff --git a/lib/unstable/Security/Signature/IOutgoingSignedRequest.php b/lib/unstable/Security/Signature/IOutgoingSignedRequest.php
index e9af12ea4b4f4..ac99c5e4a5028 100644
--- a/lib/unstable/Security/Signature/IOutgoingSignedRequest.php
+++ b/lib/unstable/Security/Signature/IOutgoingSignedRequest.php
@@ -24,6 +24,7 @@
  *
  * @see ISignatureManager for details on signature
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
  */
 interface IOutgoingSignedRequest extends ISignedRequest {
 	/**
@@ -32,6 +33,7 @@ interface IOutgoingSignedRequest extends ISignedRequest {
 	 * @param string $host
 	 * @return self
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
 	 */
 	public function setHost(string $host): self;
 
@@ -42,6 +44,7 @@ public function setHost(string $host): self;
 	 *
 	 * @return string
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
 	 */
 	public function getHost(): string;
 
@@ -53,6 +56,7 @@ public function getHost(): string;
 	 *
 	 * @return self
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
 	 */
 	public function addHeader(string $key, string|int|float $value): self;
 
@@ -61,6 +65,7 @@ public function addHeader(string $key, string|int|float $value): self;
 	 *
 	 * @return array
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
 	 */
 	public function getHeaders(): array;
 
@@ -71,6 +76,7 @@ public function getHeaders(): array;
 	 *
 	 * @return self
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
 	 */
 	public function setHeaderList(array $list): self;
 
@@ -79,6 +85,7 @@ public function setHeaderList(array $list): self;
 	 *
 	 * @return list<string>
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
 	 */
 	public function getHeaderList(): array;
 
@@ -89,6 +96,8 @@ public function getHeaderList(): array;
 	 *
 	 * @return self
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function setAlgorithm(SignatureAlgorithm $algorithm): self;
 
@@ -97,6 +106,8 @@ public function setAlgorithm(SignatureAlgorithm $algorithm): self;
 	 *
 	 * @return SignatureAlgorithm
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function getAlgorithm(): SignatureAlgorithm;
 
@@ -107,6 +118,7 @@ public function getAlgorithm(): SignatureAlgorithm;
 	 * @throws SignatoryException
 	 * @throws SignatoryNotFoundException
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\IOutgoingSignedRequest}
 	 */
 	public function sign(): self;
 }
diff --git a/lib/unstable/Security/Signature/ISignatoryManager.php b/lib/unstable/Security/Signature/ISignatoryManager.php
index c16dace1bded0..69b7c3022fac9 100644
--- a/lib/unstable/Security/Signature/ISignatoryManager.php
+++ b/lib/unstable/Security/Signature/ISignatoryManager.php
@@ -19,6 +19,7 @@
  *  be used with {@see ISignatureManager}
  *
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatoryManager}
  */
 interface ISignatoryManager {
 	/**
@@ -29,6 +30,7 @@ interface ISignatoryManager {
 	 *
 	 * @return string
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatoryManager}
 	 */
 	public function getProviderId(): string;
 
@@ -45,6 +47,7 @@ public function getProviderId(): string;
 	 *
 	 * @return array
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatoryManager}
 	 */
 	public function getOptions(): array;
 
@@ -55,6 +58,8 @@ public function getOptions(): array;
 	 *
 	 * @return Signatory
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatoryManager}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function getLocalSignatory(): Signatory;
 
@@ -68,6 +73,8 @@ public function getLocalSignatory(): Signatory;
 	 *
 	 * @return Signatory|null must be NULL if no signatory is found
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatoryManager}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function getRemoteSignatory(string $remote): ?Signatory;
 }
diff --git a/lib/unstable/Security/Signature/ISignatureManager.php b/lib/unstable/Security/Signature/ISignatureManager.php
index 655454f67e71a..3cd51d1558290 100644
--- a/lib/unstable/Security/Signature/ISignatureManager.php
+++ b/lib/unstable/Security/Signature/ISignatureManager.php
@@ -52,6 +52,7 @@
  *   instead obtained from {@see ISignatureManager::getIncomingSignedRequest}.
  *
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatureManager}
  */
 interface ISignatureManager {
 	/**
@@ -69,6 +70,8 @@ interface ISignatureManager {
 	 * @throws SignatureNotFoundException if incoming request is not signed
 	 * @throws SignatureException if signature could not be confirmed
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatureManager}
+	 * @psalm-suppress DeprecatedInterface
 	 */
 	public function getIncomingSignedRequest(ISignatoryManager $signatoryManager, ?string $body = null): IIncomingSignedRequest;
 
@@ -83,6 +86,8 @@ public function getIncomingSignedRequest(ISignatoryManager $signatoryManager, ?s
 	 *
 	 * @return IOutgoingSignedRequest
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatureManager}
+	 * @psalm-suppress DeprecatedInterface
 	 */
 	public function getOutgoingSignedRequest(ISignatoryManager $signatoryManager, string $content, string $method, string $uri): IOutgoingSignedRequest;
 
@@ -97,6 +102,8 @@ public function getOutgoingSignedRequest(ISignatoryManager $signatoryManager, st
 	 *
 	 * @return array new payload to be sent, including original payload and signature elements in headers
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatureManager}
+	 * @psalm-suppress DeprecatedInterface
 	 */
 	public function signOutgoingRequestIClientPayload(ISignatoryManager $signatoryManager, array $payload, string $method, string $uri): array;
 
@@ -109,6 +116,8 @@ public function signOutgoingRequestIClientPayload(ISignatoryManager $signatoryMa
 	 * @return Signatory
 	 * @throws SignatoryNotFoundException if entry does not exist in local database
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatureManager}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function getSignatory(string $host, string $account = ''): Signatory;
 
@@ -120,6 +129,7 @@ public function getSignatory(string $host, string $account = ''): Signatory;
 	 * @return string
 	 * @throws IdentityNotFoundException if hostname is not set
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatureManager}
 	 */
 	public function generateKeyIdFromConfig(string $path): string;
 
@@ -131,6 +141,7 @@ public function generateKeyIdFromConfig(string $path): string;
 	 * @return string
 	 * @throws IdentityNotFoundException if identity cannot be extracted
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignatureManager}
 	 */
 	public function extractIdentityFromUri(string $uri): string;
 }
diff --git a/lib/unstable/Security/Signature/ISignedRequest.php b/lib/unstable/Security/Signature/ISignedRequest.php
index 6bf5e7e7dbc00..28a9fc87b445e 100644
--- a/lib/unstable/Security/Signature/ISignedRequest.php
+++ b/lib/unstable/Security/Signature/ISignedRequest.php
@@ -24,6 +24,7 @@
  * @see IOutgoingSignedRequest
  *
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
  */
 interface ISignedRequest {
 	/**
@@ -31,6 +32,7 @@ interface ISignedRequest {
 	 *
 	 * @return string
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
 	 */
 	public function getBody(): string;
 
@@ -39,6 +41,8 @@ public function getBody(): string;
 	 *
 	 * @return DigestAlgorithm
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function getDigestAlgorithm(): DigestAlgorithm;
 
@@ -47,6 +51,7 @@ public function getDigestAlgorithm(): DigestAlgorithm;
 	 *
 	 * @return string
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
 	 */
 	public function getDigest(): string;
 
@@ -57,6 +62,7 @@ public function getDigest(): string;
 	 *
 	 * @return self
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
 	 */
 	public function setSigningElements(array $elements): self;
 
@@ -65,6 +71,7 @@ public function setSigningElements(array $elements): self;
 	 *
 	 * @return array
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
 	 */
 	public function getSigningElements(): array;
 
@@ -74,6 +81,7 @@ public function getSigningElements(): array;
 	 * @return string
 	 * @throws SignatureElementNotFoundException
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
 	 */
 	public function getSigningElement(string $key): string;
 
@@ -82,6 +90,7 @@ public function getSigningElement(string $key): string;
 	 *
 	 * @return array
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
 	 */
 	public function getSignatureData(): array;
 
@@ -90,6 +99,7 @@ public function getSignatureData(): array;
 	 *
 	 * @return string
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
 	 */
 	public function getSignature(): string;
 
@@ -99,6 +109,8 @@ public function getSignature(): string;
 	 * @param Signatory $signatory
 	 * @return self
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function setSignatory(Signatory $signatory): self;
 
@@ -108,6 +120,8 @@ public function setSignatory(Signatory $signatory): self;
 	 * @return Signatory
 	 * @throws SignatoryNotFoundException
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function getSignatory(): Signatory;
 
@@ -116,6 +130,7 @@ public function getSignatory(): Signatory;
 	 *
 	 * @return bool
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\ISignedRequest}
 	 */
 	public function hasSignatory(): bool;
 }
diff --git a/lib/unstable/Security/Signature/Model/Signatory.php b/lib/unstable/Security/Signature/Model/Signatory.php
index 6bd50bb109805..f3ae93840adbd 100644
--- a/lib/unstable/Security/Signature/Model/Signatory.php
+++ b/lib/unstable/Security/Signature/Model/Signatory.php
@@ -23,6 +23,7 @@
  * and protocol
  *
  * @experimental 31.0.0
+ * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
  *
  * @method void setProviderId(string $providerId)
  * @method string getProviderId()
@@ -66,6 +67,7 @@ class Signatory extends Entity implements JsonSerializable {
 	 * @param bool $local only set to TRUE when managing local signatory
 	 *
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
 	 */
 	public function __construct(
 		private readonly bool $local = false,
@@ -87,7 +89,9 @@ public function __construct(
 	 * @param string $keyId
 	 *
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
 	 * @throws IdentityNotFoundException if identity cannot be extracted from keyId
+	 * @psalm-suppress DeprecatedMethod
 	 */
 	public function setKeyId(string $keyId): void {
 		// if set as local (for current instance), we apply some filters.
@@ -115,6 +119,8 @@ public function setKeyId(string $keyId): void {
 	/**
 	 * @param SignatoryType $type
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function setSignatoryType(SignatoryType $type): void {
 		$this->setType($type->value);
@@ -123,6 +129,8 @@ public function setSignatoryType(SignatoryType $type): void {
 	/**
 	 * @return SignatoryType
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function getSignatoryType(): SignatoryType {
 		return SignatoryType::from($this->getType());
@@ -131,6 +139,8 @@ public function getSignatoryType(): SignatoryType {
 	/**
 	 * @param SignatoryStatus $status
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function setSignatoryStatus(SignatoryStatus $status): void {
 		$this->setStatus($status->value);
@@ -139,6 +149,8 @@ public function setSignatoryStatus(SignatoryStatus $status): void {
 	/**
 	 * @return SignatoryStatus
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public function getSignatoryStatus(): SignatoryStatus {
 		return SignatoryStatus::from($this->getStatus());
@@ -146,6 +158,7 @@ public function getSignatoryStatus(): SignatoryStatus {
 
 	/**
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
 	 */
 	public function getAccount(): string {
 		return $this->account ?? '';
@@ -157,6 +170,7 @@ public function getAccount(): string {
 	 * @param string $key
 	 * @param string|int|float|bool|array $value
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
 	 */
 	public function setMetaValue(string $key, string|int|float|bool|array $value): void {
 		$this->metadata[$key] = $value;
@@ -166,6 +180,7 @@ public function setMetaValue(string $key, string|int|float|bool|array $value): v
 	/**
 	 * @return array
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
 	 */
 	public function jsonSerialize(): array {
 		return [
@@ -182,6 +197,8 @@ public function jsonSerialize(): array {
 	 * @return string
 	 * @throws IdentityNotFoundException if identity cannot be extracted
 	 * @experimental 31.0.0
+	 * @deprecated 33.0.0 use {@see \OCP\Security\Signature\Model\Signatory}
+	 * @psalm-suppress DeprecatedClass
 	 */
 	public static function extractIdentityFromUri(string $uri): string {
 		$identity = parse_url($uri, PHP_URL_HOST);