uses JwaWinCrypt, JwaCryptUIApi...

function CryptSignMessage(pSignPara: PCRYPT_SIGN_MESSAGE_PARA;
  fDetachedSignature: BOOL; cToBeSigned: DWORD; rgpbToBeSigned: PByte;
  rgcbToBeSigned: Pointer; pbSignedBlob: PByte; var pcbSignedBlob: DWORD): BOOL;
  stdcall; external 'Crypt32.dll';

procedure SignStream(SignerCert: PCCERT_CONTEXT; ASourceStream: TStream;
  ADestStream: TStream; DetachedSignature: Boolean);
var
  SignPara: CRYPT_SIGN_MESSAGE_PARA;
  bToBeSigned: array of PByte;
  cToBeSigned: array of DWORD;
  pMsgCrl: array of PCCERT_CONTEXT;
  pbSignedBlob: PByte;
  cbSignedBlob: DWORD;
begin
  SetLength(bToBeSigned, 1);
  SetLength(cToBeSigned, 1);
  SetLength(pMsgCrl, 1);
  bToBeSigned[0] := GetMemory(ASourceStream.Size);
  cToBeSigned[0] := ASourceStream.Size;
  pMsgCrl[0] := SignerCert;
  cbSignedBlob := 0;
  try
    ASourceStream.Read(bToBeSigned[0]^, ASourceStream.Size);
    ZeroMemory(@SignPara, SizeOf(CRYPT_SIGN_MESSAGE_PARA));
    SignPara.cbSize := SizeOf(CRYPT_SIGN_MESSAGE_PARA);
    SignPara.dwMsgEncodingType := PKCS_7_ASN_ENCODING or X509_ASN_ENCODING;
    SignPara.pSigningCert := SignerCert;
    SignPara.HashAlgorithm.pszObjId := '1.2.643.100.113.1';
    SignPara.HashAlgorithm.Parameters.cbData := 0;
    SignPara.HashAlgorithm.Parameters.pbData := nil;
    SignPara.cMsgCert := 1;
    SignPara.rgpMsgCert := Pointer(pMsgCrl);

    if not(CryptSignMessage(@SignPara, DetachedSignature, 1,
      Pointer(bToBeSigned), Pointer(cToBeSigned), nil, cbSignedBlob)) then
      RaiseLastOSError;
    pbSignedBlob := GetMemory(cbSignedBlob);
    try
      if not CryptSignMessage(@SignPara, DetachedSignature, 1,
        Pointer(bToBeSigned), Pointer(cToBeSigned), pbSignedBlob,
        cbSignedBlob) then
        RaiseLastOSError;
      ADestStream.Write(pbSignedBlob^, cbSignedBlob);
    finally
      FreeMemory(pbSignedBlob);
    end;
  finally
    FreeMemory(bToBeSigned[0]);
  end;
end;

procedure TMainForm.Button1Click(Sender: TObject);
var
  cert: PCCERT_CONTEXT;
  pStreamIn, pStreamOut: TMemoryStream;
  afile: string;
  my: hcertstore;
begin
  if not OpenDialog1.Execute then Exit;

  my := CertOpenSystemStore(0, 'MY');
  cert := CryptUIDlgSelectCertificateFromStore(my, 0, '', '', 0, 0, nil);

  afile := OpenDialog1.FileName;
  pStreamIn := TMemoryStream.Create;
  pStreamOut := TMemoryStream.Create;
  pStreamIn.LoadFromFile(afile);
  SignStream(cert, pStreamIn, pStreamOut, true);
  pStreamOut.SaveToFile(afile + '.sig');
  FreeAndNil(pStreamOut);
  FreeAndNil(pStreamIn);
end;

procedure SignStreamSeveral(SignerCert: PCCERT_CONTEXT; ExistingSignerCerts: array of PCCERT_CONTEXT; ASourceStream: TStream;
  ADestStream: TStream; DetachedSignature: Boolean);
var
  SignPara: CRYPT_SIGN_MESSAGE_PARA;
  bToBeSigned: array of PByte;
  cToBeSigned: array of DWORD;
//  pMsgCrl: array of PCCERT_CONTEXT;
  pbSignedBlob: PByte;
  cbSignedBlob: DWORD;
begin
  SetLength(bToBeSigned, 1);
  SetLength(cToBeSigned, 1);
//  SetLength(pMsgCrl, 1);
  bToBeSigned[0] := GetMemory(ASourceStream.Size);
  cToBeSigned[0] := ASourceStream.Size;
//  pMsgCrl[0] := SignerCert;
  cbSignedBlob := 0;
  try
    ASourceStream.Read(bToBeSigned[0]^, ASourceStream.Size);
    ZeroMemory(@SignPara, SizeOf(CRYPT_SIGN_MESSAGE_PARA));
    SignPara.cbSize := SizeOf(CRYPT_SIGN_MESSAGE_PARA);
    SignPara.dwMsgEncodingType := PKCS_7_ASN_ENCODING or X509_ASN_ENCODING;
    SignPara.pSigningCert := SignerCert;
    SignPara.HashAlgorithm.pszObjId := '1.2.643.100.113.1';
    SignPara.HashAlgorithm.Parameters.cbData := 0;
    SignPara.HashAlgorithm.Parameters.pbData := nil;
    SignPara.cMsgCert := Length(ExistingSignerCerts);
    SignPara.rgpMsgCert := @ExistingSignerCerts; //вот этот момент меня смущает

    if not(CryptSignMessage(@SignPara, DetachedSignature, 1,
      Pointer(bToBeSigned), Pointer(cToBeSigned), nil, cbSignedBlob)) then
      RaiseLastOSError;
    pbSignedBlob := GetMemory(cbSignedBlob);
    try
      if not CryptSignMessage(@SignPara, DetachedSignature, 1,
        Pointer(bToBeSigned), Pointer(cToBeSigned), pbSignedBlob,
        cbSignedBlob) then
        RaiseLastOSError;
      ADestStream.Write(pbSignedBlob^, cbSignedBlob);
    finally
      FreeMemory(pbSignedBlob);
    end;
  finally
    FreeMemory(bToBeSigned[0]);
  end;
end;

procedure TMainForm.cxButton5Click(Sender: TObject);
var
  hMsg: HCRYPTMSG;
  cert: PCCERT_CONTEXT;
  pStreamIn, pStreamOut, pStreamResult: TMemoryStream;
  my: hcertstore;
  cib: CRYPT_INTEGER_BLOB;
  pbEncodedBlob: PByte;
  cbEncodedBlob: DWORD;

begin
  if not OpenDialog1.Execute then Exit;

  try
    hMsg := CryptMsgOpenToDecode(PKCS_7_ASN_ENCODING or X509_ASN_ENCODING, CMSG_DETACHED_FLAG, 0, 0, nil, nil);

    try
      with TMemoryStream.Create do
      try
        LoadFromFile( OpenDialog1.FileName + '.sig' );
        Win32Check( CryptMsgUpdate( hMsg, Memory, Size, true ));
      finally
        Free
      end;

      my := CertOpenSystemStore(0, 'MY');
      cert := CryptUIDlgSelectCertificateFromStore(my, 0, '', '', 0, 0, nil);

      pStreamIn := TMemoryStream.Create;
      pStreamOut := TMemoryStream.Create;
      pStreamResult := TMemoryStream.Create;
      pStreamIn.LoadFromFile(OpenDialog1.FileName);
      SignStream(cert, pStreamIn, pStreamOut, true);

      cib.cbData := pStreamOut.Size;
      cib.pbData := pStreamOut.Memory;
      if not CryptMsgControl(hMsg, 0, CMSG_CTRL_ADD_SIGNER, @cib) then
        RaiseLastOSError;

      if not CryptMsgGetParam(hMsg, CMSG_ENCODED_MESSAGE, 0, nil, cbEncodedBlob) then
        RaiseLastOSError;
      pbEncodedBlob := GetMemory(cbEncodedBlob);
      try
        if not CryptMsgGetParam(hMsg, CMSG_ENCODED_MESSAGE, 0, pbEncodedBlob, cbEncodedBlob) then
          RaiseLastOSError;
        pStreamResult.Write(pbEncodedBlob^, cbEncodedBlob);
        pStreamResult.SaveToFile(OpenDialog1.FileName + '.sig');
      finally
        FreeMemory(pbEncodedBlob);
      end;

    finally
      FreeAndNil(pStreamIn);
      FreeAndNil(pStreamOut);
      FreeAndNil(pStreamResult);
    end;

  finally

  end;
end;

function CoSignMessage(ACertContext: PCCERT_CONTEXT; // Сертификат
                              pSignedMessageStream: TMemoryStream; // уже подписаное сообщение
                              pCosignedMessageStream: TMemoryStream; // результат - соподписаное сообщение
                              var sMsg: String): boolean;  // сообщение об ошибке в случае Result := false;
var
  hProv: HCRYPTPROV;
  hMsg: HCRYPTMSG;
  dwKeySpec: DWORD;
  SignerEncodeInfo: CMSG_SIGNER_ENCODE_INFO;
  CosignCertBlob: CERT_BLOB;
  dwSize: DWORD;
  pbCoSignedBlob: PByte;
  cbCoSignedBlob: DWORD;

begin
  try
    Result := false;
    hProv := 0;
    hMsg := nil;
    dwKeySpec := 0;

//    if not CryptAcquireCertificatePrivateKey(ACertContext, 0, nil, hProv, @dwKeySpec, nil) then
//    begin
//      sMsg := 'CryptAcquireCertificatePrivateKey failed.'#13#10+SysErrorMessage(GetLastError);
//      Exit;
//    end;

    // Open a message for decoding.
    hMsg := CryptMsgOpenToDecode(MY_ENCODING_TYPE, CMSG_DETACHED_FLAG, 0, 0, nil, nil);
    if hMsg = nil then
    begin
      sMsg := 'CryptMsgOpenToDecode failed.'#13#10+SysErrorMessage(GetLastError);
      Exit;
    end;

    // Update the message with the encoded BLOB.
    if not CryptMsgUpdate(hMsg, pSignedMessageStream.Memory, pSignedMessageStream.Size,	true) then
    begin
      sMsg := 'CryptMsgUpdate failed.'#13#10+SysErrorMessage(GetLastError);
      Exit;
    end;

    // Initialize the CMSG_SIGNER_ENCODE_INFO structure for the cosigner.
    FillChar(SignerEncodeInfo, sizeof(CMSG_SIGNER_ENCODE_INFO), #0);
    SignerEncodeInfo.cbSize := sizeof(CMSG_SIGNER_ENCODE_INFO);
    SignerEncodeInfo.pCertInfo := ACertContext.pCertInfo;
    SignerEncodeInfo.hCryptProv := hProv;
    SignerEncodeInfo.dwKeySpec := dwKeySpec;
    SignerEncodeInfo.HashAlgorithm.pszObjId := ACertContext.pCertInfo.SignatureAlgorithm.pszObjId; // szOID_CP_GOST_R3411 = '1.2.643.2.2.9';

    // Add the cosigner to the message.
    if not CryptMsgControl(hMsg, 0, CMSG_CTRL_ADD_SIGNER, @SignerEncodeInfo) then
    begin
      sMsg := 'CMSG_CTRL_ADD_SIGNER failed.'#13#10+SysErrorMessage(GetLastError);
      Exit;
    end;

    // Add the cosigner's certificate to the message.
    CosignCertBlob.cbData := ACertContext.cbCertEncoded;
    CosignCertBlob.pbData := ACertContext.pbCertEncoded;
    if not CryptMsgControl(hMsg, 0, CMSG_CTRL_ADD_CERT, @CosignCertBlob) then
    begin
      sMsg := 'CMSG_CTRL_ADD_CERT failed.'#13#10+SysErrorMessage(GetLastError);
      Exit;
    end;

    // Get the size of the cosigned BLOB.
    if not CryptMsgGetParam(hMsg, CMSG_ENCODED_MESSAGE, 0, nil, cbCoSignedBlob) then
    begin
      sMsg := 'Sizing of cbSignerInfo failed.'#13#10+SysErrorMessage(GetLastError);
      Exit;
    end;

    // Allocate memory for the cosigned BLOB.
    pbCoSignedBlob := GetMemory(cbCoSignedBlob);

    // Get the cosigned message BLOB.
    try
      if not CryptMsgGetParam(hMsg, CMSG_ENCODED_MESSAGE, 0, pbCosignedBlob, cbCosignedBlob) then
      begin
        sMsg := 'Getting cosigned message failed.'#13#10+SysErrorMessage(GetLastError);
        Exit;
      end;
      pCosignedMessageStream.Write(pbCosignedBlob^, cbCosignedBlob);
      Result := True;
    finally
      FreeMemory(pbCosignedBlob);
    end;

  finally
    if (hMsg <> nil) then
    begin
      CryptMsgClose(hMsg);
    end;
  end;
end;

//так проверяю
      pStreamIn.LoadFromFile(OpenDialog1.FileName+'.sig');
      if not CertifUnit.CoSignMessage(ACert, pStreamIn, pStreamResult, S) then
        MessageDlg(S, mtWarning, [mbok], 0);