How can I use an XML detached signature when the file may be stored anywhere?
You do not need to include a URI in the Reference element of a detached signature. Just include the signature algorithm and the digest value, then you can associate signature and file by yourself.