Signature Scheme with proof of data possession
If the document is short enough, then its ISO/IEC&nbsp;9796-2 signature proves data possession, for a simple reason: in so-called total recovery mode, signature verification recovers the document as a byproduct.

ISO/IEC&nbsp;9796-2 is an RSA or Rabin signature scheme, also requiring a hash. Depending on options, the "recoverable" message (that is, embedded in the signature) can be up to about $n-h-16$ bits, for $n$-bit public modulus and $h$-bit hash. For example, with 4096-bit RSA and SHA-256, the message can be up to 478-octet, embedded in a 512-octet signature.

ISO/IEC&nbsp;9796-2 mode 1 is in wide use in Smart Cards. However, beware that it has a near-practical weakness allowing forgery from the signature of chosen messages. ISO/IEC 9796-2 mode 3 is functionally compatible with mode 1, and cures that. Both are deterministic, and maximize the size of the embedded message. ISO/IEC 9796-2 mode 2 is randomized, like RSASSA-PSS, which allows a stronger security argument, at the expense of reducing maximum message size for total recovery.



Independently: for any signature scheme with appendix signing a hash, including RSASSA-PSS and (EC)DSA, changing $\mathcal S_\text{priv}(\operatorname H(M))$ to $$\mathcal S_\text{priv}(\operatorname H(M))\|\mathcal S_\text{priv}(\operatorname{HMAC-H}(\mathcal S_\text{priv}(\operatorname H(M)),M))$$proves possession of $M$ as well as a static signature can do. That has the advantage of working with large messages. This is not standardized, but is a straightforward combination of standardized things.

Addition per comment: this is out of my head. However, the security argument (not proof) is simple:


$\operatorname{HMAC-H}$ is a standard Message Authentication Code construction from a hash.
A standard single-pass interactive proof of data possession is using $\operatorname{MAC}(R,M)$ where $R$ is a random challenge used as key of the MAC.
Signing that gives insurance that the signer is involved.
Replacing $R$ with the signature of the hash makes it non-interactive and invoking the signer before the HMAC could be computed, yet verifiable.


Still, a dishonest signer can offload all hashing to a third party, but that seems inevitable. And an imprudent signer hashing-and-signing any message can be abused into signing a proof of possession of something s/he did not keep (because HMAC's result is a hash).

Note: I chose this, at the price of requiring two signatures, rather than
$$\mathcal S_\text{priv}(\operatorname H(M))\|\operatorname{HMAC-H}(\mathcal S_\text{priv}(\operatorname H(M)),M)$$
because:


The security argument of the former is more straightforward.
The later succumbs if $H$ turns out not to be collision-resistant: an attacker could find $M$ and $M'$ with $H(M)=H(M')$, give $M'$ to signer, obtain $\mathcal S_\text{priv}(\operatorname H(M'))$ as part of proof of possession of $M'$ by honest signer, and turn that into a (different) forged proof of possession of $M$, when the honest signer never knew that $M$.
Involving the signer at beginning and end of preparation of the proof of possession arguably makes repudiation harder.