When implementing the DSign API, I thought I put all the configuration options into SignatureConfig, also this class was designed with dependency injection in mind. To cope with the per document configuration, I've introduced ThreadLocals. I think this is a design flaw, as the ThreadLocals seldom get cleared again and so I would like to move the per document configuration into SignatureInfo. I couldn't keep the internal API stable, but the usercode side should be stable till POI 5.0. The code still contains the ThreadLocals, but when the usercodes migrates to using SignatureInfo instead, the ThreadLocals stay left uninitialized.
applied via r1874671
Please note that we provide org.apache.poi.util.ThreadLocalUtil#clearAllThreadLocals() to allow users to clear any leftover ThreadLocals in Threads, e.g. before they are returned to a thread-pool. Maybe we should also clear these until we can remove them completely?