How to create new pdf with watermark, string and signatur with a script?

If you're familiar with bash, the process of "apply something to a lot of files" is trivial: just make the "something" either a shell function

something() {
  infile="$1"
  outfile="$2"
  dothefirststep "${infile}"
  dothesecondstep -o "${outfile}" …
}

or put the something in a shell or perl script file (say, something.sh or something.pl), make it executable, and then run each file matching a glob through it:

for file in *.pdf; do something "${file}" "${file%.pdf}-signed.pdf"; done

Now, how does one add watermarks? Never done this myself, because I consider it a nuisance to the user that should not be done, but OK, it's your job, can't tell you what to do. How you'd do it:

Preparation:

0. Get your certificate in PEM format and your private signing key (matching that certificate, of course) in PEM format
1. take your watermark images and make page-sized PDFs out of them, with transparent background. Inkscape is an easy way to create such single-page PDFs.
2. Write a script to put a watermark atop of each page. I'd probably use Python and the PyPDF2 library. The following is top-of-my-head, untested code. You'll probably have to fiddle with it until it works (I call it watermark.py:

#!/usr/bin/env python3
from sys import argv
from PyPDF2 import PdfReader, PdfWriter

with open(argv[1], "rb") as in_file, open(argv[2], "rb") as wtrmrk_file:
  out = PdfWriter()
  document = PdfReader(in_file)
  watermark = PdfReader(wtrmrk_file).pages[0]

  for page in document.pages:
    page.merge_page(watermark)
    out.add_page(page)

  with open(argv[3], "wb") as out_file:
    out.write(out_file)

(chmod 755 watermark.py, and you can run it as /path/to/watermark.py infile.pdf watermark.pdf outfile.pdf)

3. You'll want to install libpodofo-utils (or however it's called on your distro, but on debian, that's the name), and make sure you have the podofosign program.

Now, everything falls into place, in bash:

sign() {
  infile=$1
  outfile=$2
  podofosign -in "${infile}" -cert "yourcert.pem" -pkey "yourkey.pem" -out "${outfile}"
}

mark() {
  infile=$1
  outfile=$2
  /path/to/watermark "${infile}" "yourwatermark.pdf" "${outfile}"
}

mark_and_sign() {
  infile=$1
  mark "${infile}" "${infile%.pdf}-marked.pdf"
  sign "${infile%.pdf}-marked.pdf" "${infile%.pdf}-signed.pdf"
  # optionally delete unsigned watermarked file:
  # rm "${infile%.pdf}-marked.pdf"
}

for file in *.pdf; do
  mark_and_sign "${file}"
done