diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8a942b06..1186dd62 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,36 +1,48 @@
 # Changelog
 
+## [v1.5.1-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.5.1-pre1) (2025-05-29)
+
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.2...v1.5.1-pre1)
+
+## [v1.5.2](https://github.com/microsoft/CoseSignTool/tree/v1.5.2) (2025-05-29)
+
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.0-pre1...v1.5.2)
+
+**Merged pull requests:**
+
+- feat: Add header extender support to IndirectSignatureFactory [\#130](https://github.com/microsoft/CoseSignTool/pull/130) ([JeromySt](https://github.com/JeromySt))
+
 ## [v1.5.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.5.0-pre1) (2025-05-07)
 
 [Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.1...v1.5.0-pre1)
 
 ## [v1.5.1](https://github.com/microsoft/CoseSignTool/tree/v1.5.1) (2025-05-07)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.4.0-pre1...v1.5.1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.0...v1.5.1)
 
 **Merged pull requests:**
 
 - Allow beta version of Azure.Security.CodeTransparency [\#129](https://github.com/microsoft/CoseSignTool/pull/129) ([lemccomb](https://github.com/lemccomb))
 
-## [v1.4.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.4.0-pre1) (2025-04-28)
+## [v1.5.0](https://github.com/microsoft/CoseSignTool/tree/v1.5.0) (2025-04-28)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.5.0...v1.4.0-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.4.0-pre1...v1.5.0)
 
-## [v1.5.0](https://github.com/microsoft/CoseSignTool/tree/v1.5.0) (2025-04-28)
+## [v1.4.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.4.0-pre1) (2025-04-28)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.4.0...v1.5.0)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.3.0-pre5...v1.4.0-pre1)
 
 **Merged pull requests:**
 
 - Added support for Transparency to CoseSign1 libraries to leverage services such as Azure Code Transparency Service [\#127](https://github.com/microsoft/CoseSignTool/pull/127) ([JeromySt](https://github.com/JeromySt))
 
-## [v1.4.0](https://github.com/microsoft/CoseSignTool/tree/v1.4.0) (2025-03-18)
+## [v1.3.0-pre5](https://github.com/microsoft/CoseSignTool/tree/v1.3.0-pre5) (2025-03-18)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.3.0-pre5...v1.4.0)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.4.0...v1.3.0-pre5)
 
-## [v1.3.0-pre5](https://github.com/microsoft/CoseSignTool/tree/v1.3.0-pre5) (2025-03-18)
+## [v1.4.0](https://github.com/microsoft/CoseSignTool/tree/v1.4.0) (2025-03-18)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.3.0-pre4...v1.3.0-pre5)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.3.0-pre4...v1.4.0)
 
 **Merged pull requests:**
 
@@ -252,19 +264,19 @@
 
 ## [v1.2.3-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.2.3-pre1) (2024-05-31)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.3...v1.2.3-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.2-pre1...v1.2.3-pre1)
 
 **Merged pull requests:**
 
 - upgrade to .NET 8, add docs to package, add retry loop for revocation server [\#89](https://github.com/microsoft/CoseSignTool/pull/89) ([lemccomb](https://github.com/lemccomb))
 
-## [v1.2.3](https://github.com/microsoft/CoseSignTool/tree/v1.2.3) (2024-03-20)
+## [v1.2.2-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.2.2-pre1) (2024-03-20)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.2-pre1...v1.2.3)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.3...v1.2.2-pre1)
 
-## [v1.2.2-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.2.2-pre1) (2024-03-20)
+## [v1.2.3](https://github.com/microsoft/CoseSignTool/tree/v1.2.3) (2024-03-20)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.1-pre2...v1.2.2-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.1-pre2...v1.2.3)
 
 **Merged pull requests:**
 
@@ -284,19 +296,19 @@
 
 ## [v1.2.2](https://github.com/microsoft/CoseSignTool/tree/v1.2.2) (2024-03-12)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.0-pre1...v1.2.2)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.1...v1.2.2)
 
 **Merged pull requests:**
 
 - Revert "Add .exe to CoseSignTool NuGet" [\#83](https://github.com/microsoft/CoseSignTool/pull/83) ([elantiguamsft](https://github.com/elantiguamsft))
 
-## [v1.2.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.2.0-pre1) (2024-03-07)
+## [v1.2.1](https://github.com/microsoft/CoseSignTool/tree/v1.2.1) (2024-03-07)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.1...v1.2.0-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.0-pre1...v1.2.1)
 
-## [v1.2.1](https://github.com/microsoft/CoseSignTool/tree/v1.2.1) (2024-03-07)
+## [v1.2.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.2.0-pre1) (2024-03-07)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.exeTest...v1.2.1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.2.exeTest...v1.2.0-pre1)
 
 **Merged pull requests:**
 
@@ -312,19 +324,19 @@
 
 ## [v1.1.8-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.8-pre1) (2024-03-04)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.7-pre3...v1.1.8-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.8...v1.1.8-pre1)
 
 **Merged pull requests:**
 
 - Update Nuspec for CoseIndirectSignature [\#80](https://github.com/microsoft/CoseSignTool/pull/80) ([elantiguamsft](https://github.com/elantiguamsft))
 
-## [v1.1.7-pre3](https://github.com/microsoft/CoseSignTool/tree/v1.1.7-pre3) (2024-03-02)
+## [v1.1.8](https://github.com/microsoft/CoseSignTool/tree/v1.1.8) (2024-03-02)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.8...v1.1.7-pre3)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.7-pre3...v1.1.8)
 
-## [v1.1.8](https://github.com/microsoft/CoseSignTool/tree/v1.1.8) (2024-03-02)
+## [v1.1.7-pre3](https://github.com/microsoft/CoseSignTool/tree/v1.1.7-pre3) (2024-03-02)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.7-pre2...v1.1.8)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.7-pre2...v1.1.7-pre3)
 
 **Merged pull requests:**
 
@@ -340,19 +352,19 @@
 
 ## [v1.1.7-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.7-pre1) (2024-02-14)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.7...v1.1.7-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.6-pre1...v1.1.7-pre1)
 
 **Merged pull requests:**
 
 - Command Line Validation of Indirect Signatures [\#78](https://github.com/microsoft/CoseSignTool/pull/78) ([elantiguamsft](https://github.com/elantiguamsft))
 
-## [v1.1.7](https://github.com/microsoft/CoseSignTool/tree/v1.1.7) (2024-02-07)
+## [v1.1.6-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.6-pre1) (2024-02-07)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.6-pre1...v1.1.7)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.7...v1.1.6-pre1)
 
-## [v1.1.6-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.6-pre1) (2024-02-07)
+## [v1.1.7](https://github.com/microsoft/CoseSignTool/tree/v1.1.7) (2024-02-07)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.6...v1.1.6-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.6...v1.1.7)
 
 **Merged pull requests:**
 
@@ -372,43 +384,43 @@
 
 ## [v1.1.4-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.4-pre1) (2024-01-31)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.4...v1.1.4-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.3-pre1...v1.1.4-pre1)
 
 **Merged pull requests:**
 
 - write validation output to standard out [\#74](https://github.com/microsoft/CoseSignTool/pull/74) ([elantiguamsft](https://github.com/elantiguamsft))
 
-## [v1.1.4](https://github.com/microsoft/CoseSignTool/tree/v1.1.4) (2024-01-26)
+## [v1.1.3-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.3-pre1) (2024-01-26)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.3-pre1...v1.1.4)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.4...v1.1.3-pre1)
 
-## [v1.1.3-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.3-pre1) (2024-01-26)
+## [v1.1.4](https://github.com/microsoft/CoseSignTool/tree/v1.1.4) (2024-01-26)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.2-pre1...v1.1.3-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.3...v1.1.4)
 
 **Merged pull requests:**
 
 - Adding Validation Option to Output Certificate Chain [\#73](https://github.com/microsoft/CoseSignTool/pull/73) ([elantiguamsft](https://github.com/elantiguamsft))
 
-## [v1.1.2-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.2-pre1) (2024-01-24)
+## [v1.1.3](https://github.com/microsoft/CoseSignTool/tree/v1.1.3) (2024-01-24)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.3...v1.1.2-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.2-pre1...v1.1.3)
 
-## [v1.1.3](https://github.com/microsoft/CoseSignTool/tree/v1.1.3) (2024-01-24)
+## [v1.1.2-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.2-pre1) (2024-01-24)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.1-pre2...v1.1.3)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.2...v1.1.2-pre1)
 
 **Merged pull requests:**
 
 - Updating snk for internal package compatibility [\#72](https://github.com/microsoft/CoseSignTool/pull/72) ([elantiguamsft](https://github.com/elantiguamsft))
 
-## [v1.1.1-pre2](https://github.com/microsoft/CoseSignTool/tree/v1.1.1-pre2) (2024-01-18)
+## [v1.1.2](https://github.com/microsoft/CoseSignTool/tree/v1.1.2) (2024-01-18)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.2...v1.1.1-pre2)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.1-pre2...v1.1.2)
 
-## [v1.1.2](https://github.com/microsoft/CoseSignTool/tree/v1.1.2) (2024-01-18)
+## [v1.1.1-pre2](https://github.com/microsoft/CoseSignTool/tree/v1.1.1-pre2) (2024-01-18)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.1-pre1...v1.1.2)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.1-pre1...v1.1.1-pre2)
 
 **Merged pull requests:**
 
@@ -416,19 +428,19 @@
 
 ## [v1.1.1-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.1-pre1) (2024-01-17)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.0-pre7...v1.1.1-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.1...v1.1.1-pre1)
 
 **Merged pull requests:**
 
 - Move CreateChangelog to after build in PR build [\#70](https://github.com/microsoft/CoseSignTool/pull/70) ([lemccomb](https://github.com/lemccomb))
 
-## [v1.1.0-pre7](https://github.com/microsoft/CoseSignTool/tree/v1.1.0-pre7) (2024-01-12)
+## [v1.1.1](https://github.com/microsoft/CoseSignTool/tree/v1.1.1) (2024-01-12)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.1...v1.1.0-pre7)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.0-pre7...v1.1.1)
 
-## [v1.1.1](https://github.com/microsoft/CoseSignTool/tree/v1.1.1) (2024-01-12)
+## [v1.1.0-pre7](https://github.com/microsoft/CoseSignTool/tree/v1.1.0-pre7) (2024-01-12)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.0-pre6...v1.1.1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.0-pre6...v1.1.0-pre7)
 
 **Merged pull requests:**
 
@@ -477,7 +489,7 @@
 
 ## [v1.1.0-pre1](https://github.com/microsoft/CoseSignTool/tree/v1.1.0-pre1) (2023-11-03)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.10...v1.1.0-pre1)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.0...v1.1.0-pre1)
 
 **Merged pull requests:**
 
@@ -487,13 +499,13 @@
 - DetachedSignatureFactory accepts pre-hashed content as payload [\#53](https://github.com/microsoft/CoseSignTool/pull/53) ([elantiguamsft](https://github.com/elantiguamsft))
 - Add password support for certificate files [\#52](https://github.com/microsoft/CoseSignTool/pull/52) ([lemccomb](https://github.com/lemccomb))
 
-## [v0.3.1-pre.10](https://github.com/microsoft/CoseSignTool/tree/v0.3.1-pre.10) (2023-10-10)
+## [v1.1.0](https://github.com/microsoft/CoseSignTool/tree/v1.1.0) (2023-10-10)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v1.1.0...v0.3.1-pre.10)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.10...v1.1.0)
 
-## [v1.1.0](https://github.com/microsoft/CoseSignTool/tree/v1.1.0) (2023-10-10)
+## [v0.3.1-pre.10](https://github.com/microsoft/CoseSignTool/tree/v0.3.1-pre.10) (2023-10-10)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.9...v1.1.0)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.2...v0.3.1-pre.10)
 
 **Merged pull requests:**
 
@@ -503,13 +515,13 @@
 - Port changes from ADO repo to GitHub repo [\#46](https://github.com/microsoft/CoseSignTool/pull/46) ([lemccomb](https://github.com/lemccomb))
 - Re-enable CodeQL [\#45](https://github.com/microsoft/CoseSignTool/pull/45) ([lemccomb](https://github.com/lemccomb))
 
-## [v0.3.1-pre.9](https://github.com/microsoft/CoseSignTool/tree/v0.3.1-pre.9) (2023-09-28)
+## [v0.3.2](https://github.com/microsoft/CoseSignTool/tree/v0.3.2) (2023-09-28)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.2...v0.3.1-pre.9)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.9...v0.3.2)
 
-## [v0.3.2](https://github.com/microsoft/CoseSignTool/tree/v0.3.2) (2023-09-28)
+## [v0.3.1-pre.9](https://github.com/microsoft/CoseSignTool/tree/v0.3.1-pre.9) (2023-09-28)
 
-[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.8...v0.3.2)
+[Full Changelog](https://github.com/microsoft/CoseSignTool/compare/v0.3.1-pre.8...v0.3.1-pre.9)
 
 **Merged pull requests:**
 
diff --git a/CoseIndirectSignature/IndirectSignatureFactory.Stream.cs b/CoseIndirectSignature/IndirectSignatureFactory.Stream.cs
index 0f310762..cdd4e48c 100644
--- a/CoseIndirectSignature/IndirectSignatureFactory.Stream.cs
+++ b/CoseIndirectSignature/IndirectSignatureFactory.Stream.cs
@@ -17,13 +17,15 @@ public sealed partial class IndirectSignatureFactory
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="useOldFormat">True to use the older format - CoseHashV, False to use CoseHashEnvelope format (default).</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A Task which can be awaited which will return a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     public CoseSign1Message CreateIndirectSignature(
         Stream payload,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        bool useOldFormat = false) =>
+        bool useOldFormat = false,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             CreateIndirectSignature(
                 payload: payload,
                 signingKeyProvider: signingKeyProvider,
@@ -33,7 +35,8 @@ public CoseSign1Message CreateIndirectSignature(
 #pragma warning disable CS0618 // Type or member is obsolete
                         ? IndirectSignatureVersion.CoseHashV
 #pragma warning restore CS0618 // Type or member is obsolete
-                        : IndirectSignatureVersion.CoseHashEnvelope);
+                        : IndirectSignatureVersion.CoseHashEnvelope,
+                coseHeaderExtender: coseHeaderExtender);
 
     /// <summary>
     /// Creates a Indirect signature of the payload given a hash of the payload returned as a <see cref="CoseSign1Message"/> following the rules in this class description.
@@ -42,6 +45,7 @@ public CoseSign1Message CreateIndirectSignature(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="useOldFormat">True to use the older format - CoseHashV, False to use CoseHashEnvelope format (default).</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     /// <exception cref="ArgumentException">Hash size does not correspond to any known hash algorithms</exception>
@@ -49,7 +53,8 @@ public CoseSign1Message CreateIndirectSignatureFromHash(
         Stream rawHash,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        bool useOldFormat = false) =>
+        bool useOldFormat = false,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             CreateIndirectSignatureFromHash(
                 rawHash: rawHash,
                 signingKeyProvider: signingKeyProvider,
@@ -59,7 +64,8 @@ public CoseSign1Message CreateIndirectSignatureFromHash(
 #pragma warning disable CS0618 // Type or member is obsolete
                         ? IndirectSignatureVersion.CoseHashV
 #pragma warning restore CS0618 // Type or member is obsolete
-                        : IndirectSignatureVersion.CoseHashEnvelope);
+                        : IndirectSignatureVersion.CoseHashEnvelope,
+                coseHeaderExtender: coseHeaderExtender);
 
     /// <summary>
     /// Creates a Indirect signature of the specified payload returned as a <see cref="CoseSign1Message"/> following the rules in this class description.
@@ -68,13 +74,15 @@ public CoseSign1Message CreateIndirectSignatureFromHash(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="useOldFormat">True to use the older format - CoseHashV, False to use CoseHashEnvelope format (default).</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A Task which can be awaited which will return a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     public Task<CoseSign1Message> CreateIndirectSignatureAsync(
         Stream payload,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        bool useOldFormat = false) =>
+        bool useOldFormat = false,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             CreateIndirectSignatureAsync(
                 payload: payload,
                 signingKeyProvider: signingKeyProvider,
@@ -84,7 +92,8 @@ public Task<CoseSign1Message> CreateIndirectSignatureAsync(
 #pragma warning disable CS0618 // Type or member is obsolete
                         ? IndirectSignatureVersion.CoseHashV
 #pragma warning restore CS0618 // Type or member is obsolete
-                        : IndirectSignatureVersion.CoseHashEnvelope);
+                        : IndirectSignatureVersion.CoseHashEnvelope,
+                coseHeaderExtender: coseHeaderExtender);
 
     /// <summary>
     /// Creates a Indirect signature of the payload given a hash of the payload returned as a <see cref="CoseSign1Message"/> following the rules in this class description.
@@ -93,6 +102,7 @@ public Task<CoseSign1Message> CreateIndirectSignatureAsync(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="useOldFormat">True to use the older format - CoseHashV, False to use CoseHashEnvelope format (default).</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     /// <exception cref="ArgumentException">Hash size does not correspond to any known hash algorithms</exception>
@@ -100,7 +110,8 @@ public Task<CoseSign1Message> CreateIndirectSignatureFromHashAsync(
         Stream rawHash,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        bool useOldFormat = false) =>
+        bool useOldFormat = false,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             CreateIndirectSignatureFromHashAsync(
                 rawHash: rawHash,
                 signingKeyProvider: signingKeyProvider,
@@ -110,7 +121,8 @@ public Task<CoseSign1Message> CreateIndirectSignatureFromHashAsync(
 #pragma warning disable CS0618 // Type or member is obsolete
                         ? IndirectSignatureVersion.CoseHashV
 #pragma warning restore CS0618 // Type or member is obsolete
-                        : IndirectSignatureVersion.CoseHashEnvelope);
+                        : IndirectSignatureVersion.CoseHashEnvelope,
+                coseHeaderExtender: coseHeaderExtender);
     #endregion
     #region new sync signature
     /// <summary>
@@ -120,19 +132,22 @@ public Task<CoseSign1Message> CreateIndirectSignatureFromHashAsync(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="signatureVersion">The <see cref="IndirectSignatureVersion"/> this factory should create.</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A Task which can be awaited which will return a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     public CoseSign1Message CreateIndirectSignature(
         Stream payload,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        IndirectSignatureVersion signatureVersion) =>
+        IndirectSignatureVersion signatureVersion,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             (CoseSign1Message)CreateIndirectSignatureWithChecksInternal(
                 returnBytes: false,
                 signingKeyProvider: signingKeyProvider,
                 contentType: contentType,
                 streamPayload: payload,
-                signatureVersion: signatureVersion);
+                signatureVersion: signatureVersion,
+                headerExtender: coseHeaderExtender);
 
     /// <summary>
     /// Creates a Indirect signature of the payload given a hash of the payload returned as a <see cref="CoseSign1Message"/> following the rules in this class description.
@@ -141,6 +156,7 @@ public CoseSign1Message CreateIndirectSignature(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="signatureVersion">The <see cref="IndirectSignatureVersion"/> this factory should create.</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     /// <exception cref="ArgumentException">Hash size does not correspond to any known hash algorithms</exception>
@@ -148,14 +164,16 @@ public CoseSign1Message CreateIndirectSignatureFromHash(
         Stream rawHash,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        IndirectSignatureVersion signatureVersion) =>
+        IndirectSignatureVersion signatureVersion,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             (CoseSign1Message)CreateIndirectSignatureWithChecksInternal(
                 returnBytes: false,
                 signingKeyProvider: signingKeyProvider,
                 contentType: contentType,
                 streamPayload: rawHash,
                 payloadHashed: true,
-                signatureVersion: signatureVersion);
+                signatureVersion: signatureVersion,
+                headerExtender: coseHeaderExtender);
     #endregion
     #region new async signature
     /// <summary>
@@ -165,20 +183,23 @@ public CoseSign1Message CreateIndirectSignatureFromHash(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="signatureVersion">The <see cref="IndirectSignatureVersion"/> this factory should create.</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A Task which can be awaited which will return a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     public Task<CoseSign1Message> CreateIndirectSignatureAsync(
         Stream payload,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        IndirectSignatureVersion signatureVersion) =>
+        IndirectSignatureVersion signatureVersion,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             Task.FromResult(
                 (CoseSign1Message)CreateIndirectSignatureWithChecksInternal(
                     returnBytes: false,
                     signingKeyProvider: signingKeyProvider,
                     contentType: contentType,
                     streamPayload: payload,
-                    signatureVersion: signatureVersion));
+                    signatureVersion: signatureVersion,
+                    headerExtender: coseHeaderExtender));
 
     /// <summary>
     /// Creates a Indirect signature of the payload given a hash of the payload returned as a <see cref="CoseSign1Message"/> following the rules in this class description.
@@ -187,6 +208,7 @@ public Task<CoseSign1Message> CreateIndirectSignatureAsync(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="signatureVersion">The <see cref="IndirectSignatureVersion"/> this factory should create.</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     /// <exception cref="ArgumentException">Hash size does not correspond to any known hash algorithms</exception>
@@ -194,7 +216,8 @@ public Task<CoseSign1Message> CreateIndirectSignatureFromHashAsync(
         Stream rawHash,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        IndirectSignatureVersion signatureVersion) =>
+        IndirectSignatureVersion signatureVersion,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             Task.FromResult(
                 (CoseSign1Message)CreateIndirectSignatureWithChecksInternal(
                     returnBytes: false,
@@ -202,7 +225,8 @@ public Task<CoseSign1Message> CreateIndirectSignatureFromHashAsync(
                     contentType: contentType,
                     streamPayload: rawHash,
                     payloadHashed: true,
-                    signatureVersion: signatureVersion));
+                    signatureVersion: signatureVersion,
+                    headerExtender: coseHeaderExtender));
     #endregion
     #endregion
 
@@ -215,13 +239,15 @@ public Task<CoseSign1Message> CreateIndirectSignatureFromHashAsync(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="useOldFormat">True to use the older format - CoseHashV, False to use CoseHashEnvelope format (default).</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A byte[] representation of a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     public ReadOnlyMemory<byte> CreateIndirectSignatureBytes(
         Stream payload,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        bool useOldFormat = false) =>
+        bool useOldFormat = false,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             CreateIndirectSignatureBytes(
                 payload: payload,
                 signingKeyProvider: signingKeyProvider,
@@ -231,7 +257,8 @@ public ReadOnlyMemory<byte> CreateIndirectSignatureBytes(
 #pragma warning disable CS0618 // Type or member is obsolete
                         ? IndirectSignatureVersion.CoseHashV
 #pragma warning restore CS0618 // Type or member is obsolete
-                        : IndirectSignatureVersion.CoseHashEnvelope);
+                        : IndirectSignatureVersion.CoseHashEnvelope,
+                coseHeaderExtender: coseHeaderExtender);
 
     /// <summary>
     /// Creates a Indirect signature of the payload given a hash of the payload returned as a <see cref="CoseSign1Message"/> following the rules in this class description.
@@ -240,6 +267,7 @@ public ReadOnlyMemory<byte> CreateIndirectSignatureBytes(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="useOldFormat">True to use the older format - CoseHashV, False to use CoseHashEnvelope format (default).</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A byte[] representation of a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     /// <exception cref="ArgumentException">Hash size does not correspond to any known hash algorithms</exception>
@@ -247,7 +275,8 @@ public ReadOnlyMemory<byte> CreateIndirectSignatureBytesFromHash(
         Stream rawHash,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        bool useOldFormat = false) =>
+        bool useOldFormat = false,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             CreateIndirectSignatureBytesFromHash(
                 rawHash: rawHash,
                 signingKeyProvider: signingKeyProvider,
@@ -257,7 +286,8 @@ public ReadOnlyMemory<byte> CreateIndirectSignatureBytesFromHash(
 #pragma warning disable CS0618 // Type or member is obsolete
                         ? IndirectSignatureVersion.CoseHashV
 #pragma warning restore CS0618 // Type or member is obsolete
-                        : IndirectSignatureVersion.CoseHashEnvelope);
+                        : IndirectSignatureVersion.CoseHashEnvelope,
+                coseHeaderExtender: coseHeaderExtender);
     #endregion
     #region async old signature - backwards compatibility
     /// <summary>
@@ -267,13 +297,15 @@ public ReadOnlyMemory<byte> CreateIndirectSignatureBytesFromHash(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="useOldFormat">True to use the older format - CoseHashV, False to use CoseHashEnvelope format (default).</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A Task which when completed returns a byte[] representation of a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesAsync(
         Stream payload,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        bool useOldFormat = false) =>
+        bool useOldFormat = false,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             CreateIndirectSignatureBytesAsync(
                 payload: payload,
                 signingKeyProvider: signingKeyProvider,
@@ -283,7 +315,8 @@ public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesAsync(
 #pragma warning disable CS0618 // Type or member is obsolete
                         ? IndirectSignatureVersion.CoseHashV
 #pragma warning restore CS0618 // Type or member is obsolete
-                        : IndirectSignatureVersion.CoseHashEnvelope);
+                        : IndirectSignatureVersion.CoseHashEnvelope,
+                coseHeaderExtender: coseHeaderExtender);
 
     /// <summary>
     /// Creates a Indirect signature of the payload given a hash of the payload returned as a <see cref="CoseSign1Message"/> following the rules in this class description.
@@ -292,6 +325,7 @@ public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesAsync(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="useOldFormat">True to use the older format - CoseHashV, False to use CoseHashEnvelope format (default).</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A Task which when completed returns a byte[] representation of a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     /// <exception cref="ArgumentException">Hash size does not correspond to any known hash algorithms</exception>
@@ -299,7 +333,8 @@ public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesFromHashAsync(
         Stream rawHash,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        bool useOldFormat = false) =>
+        bool useOldFormat = false,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             CreateIndirectSignatureBytesFromHashAsync(
                 rawHash: rawHash,
                 signingKeyProvider: signingKeyProvider,
@@ -309,7 +344,8 @@ public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesFromHashAsync(
 #pragma warning disable CS0618 // Type or member is obsolete
                         ? IndirectSignatureVersion.CoseHashV
 #pragma warning restore CS0618 // Type or member is obsolete
-                        : IndirectSignatureVersion.CoseHashEnvelope);
+                        : IndirectSignatureVersion.CoseHashEnvelope,
+                coseHeaderExtender: coseHeaderExtender);
     #endregion
     #region new sync signature
     /// <summary>
@@ -319,20 +355,23 @@ public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesFromHashAsync(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="signatureVersion">The <see cref="IndirectSignatureVersion"/> this factory should create.</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A byte[] representation of a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     public ReadOnlyMemory<byte> CreateIndirectSignatureBytes(
         Stream payload,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        IndirectSignatureVersion signatureVersion) =>
+        IndirectSignatureVersion signatureVersion,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             (ReadOnlyMemory<byte>)CreateIndirectSignatureWithChecksInternal(
                 returnBytes: true,
                 signingKeyProvider: signingKeyProvider,
                 contentType: contentType,
                 streamPayload: payload,
                 payloadHashed: false,
-                signatureVersion: signatureVersion);
+                signatureVersion: signatureVersion,
+                headerExtender: coseHeaderExtender);
 
     /// <summary>
     /// Creates a Indirect signature of the payload given a hash of the payload returned as a <see cref="CoseSign1Message"/> following the rules in this class description.
@@ -341,6 +380,7 @@ public ReadOnlyMemory<byte> CreateIndirectSignatureBytes(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="signatureVersion">The <see cref="IndirectSignatureVersion"/> this factory should create.</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A byte[] representation of a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     /// <exception cref="ArgumentException">Hash size does not correspond to any known hash algorithms</exception>
@@ -348,14 +388,16 @@ public ReadOnlyMemory<byte> CreateIndirectSignatureBytesFromHash(
         Stream rawHash,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        IndirectSignatureVersion signatureVersion) =>
+        IndirectSignatureVersion signatureVersion,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             (ReadOnlyMemory<byte>)CreateIndirectSignatureWithChecksInternal(
                 returnBytes: true,
                 signingKeyProvider: signingKeyProvider,
                 contentType: contentType,
                 streamPayload: rawHash,
                 payloadHashed: true,
-                signatureVersion: signatureVersion);
+                signatureVersion: signatureVersion,
+                headerExtender: coseHeaderExtender);
     #endregion
     #region new async signature
     /// <summary>
@@ -365,13 +407,15 @@ public ReadOnlyMemory<byte> CreateIndirectSignatureBytesFromHash(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="signatureVersion">The <see cref="IndirectSignatureVersion"/> this factory should create.</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A Task which when completed returns a byte[] representation of a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesAsync(
         Stream payload,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        IndirectSignatureVersion signatureVersion) =>
+        IndirectSignatureVersion signatureVersion,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             Task.FromResult(
                 (ReadOnlyMemory<byte>)CreateIndirectSignatureWithChecksInternal(
                     returnBytes: true,
@@ -379,7 +423,8 @@ public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesAsync(
                     contentType: contentType,
                     streamPayload: payload,
                     payloadHashed: false,
-                    signatureVersion: signatureVersion));
+                    signatureVersion: signatureVersion,
+                    headerExtender: coseHeaderExtender));
 
     /// <summary>
     /// Creates a Indirect signature of the payload given a hash of the payload returned as a <see cref="CoseSign1Message"/> following the rules in this class description.
@@ -388,6 +433,7 @@ public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesAsync(
     /// <param name="signingKeyProvider">The COSE signing key provider to be used for the signing operation within the <see cref="ICoseSign1MessageFactory"/>.</param>
     /// <param name="contentType">A media type string following https://datatracker.ietf.org/doc/html/rfc6838.</param>
     /// <param name="signatureVersion">The <see cref="IndirectSignatureVersion"/> this factory should create.</param>
+    /// <param name="coseHeaderExtender">Optional header extender to add custom headers to the COSE message.</param>
     /// <returns>A Task which when completed returns a byte[] representation of a CoseSign1Message which can be used as a Indirect signature validation of the payload.</returns>
     /// <exception cref="ArgumentNullException">The contentType parameter was empty or null</exception>
     /// <exception cref="ArgumentException">Hash size does not correspond to any known hash algorithms</exception>
@@ -395,7 +441,8 @@ public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesFromHashAsync(
         Stream rawHash,
         ICoseSigningKeyProvider signingKeyProvider,
         string contentType,
-        IndirectSignatureVersion signatureVersion) =>
+        IndirectSignatureVersion signatureVersion,
+        ICoseHeaderExtender? coseHeaderExtender = null) =>
             Task.FromResult(
                 (ReadOnlyMemory<byte>)CreateIndirectSignatureWithChecksInternal(
                     returnBytes: true,
@@ -403,7 +450,8 @@ public Task<ReadOnlyMemory<byte>> CreateIndirectSignatureBytesFromHashAsync(
                     contentType: contentType,
                     streamPayload: rawHash,
                     payloadHashed: true,
-                    signatureVersion: signatureVersion));
+                    signatureVersion: signatureVersion,
+                    headerExtender: coseHeaderExtender));
     #endregion
     #endregion
 }