You can apply transforms to the xml, canonicalize the document, take a hash and sign the hash using pkcs11.

once you the signature value, you can then use xpath to insert signaturevalue in the signature element for an enveloped signature.

the x509 cert goes into the keyinfo element in the signedxml.