How does codesign and signing of profiles on os x work?
I suspect writing an equivalent to codesign on a non-Apple platform will be tricky; but you might be lucky as parts may be open source.

Consider having a Mac provide a code signing service solely for your web server. Then you can use Apple's codesign but avoid using the Mac as the public server. 

Apple provide two useful documents about code signing:


Code Signing Guide
OS X Code Signing In Depth


The technical note is a great source of information for how codesign works and has changed across different editions of OS X:


  The purpose of this technote is to provide a more in depth view of code signing. It is intended to expand upon the information given in the Code Signing Guide by supplying a more detailed analysis of the technology. The target audience for this document is OS X developers who have read and presumably understand the information given in the Code Signing Guide but want to learn a bit more.