Yes, you are on the right track. With Update 11, the ability to add a signature to a Task Step was added as a baseline feature using the configurable Signature API. Look at that feature for an example on how to configure a signature.
Since you highlighted “custom metadata,” I’m guessing that's where you’re stuck. Since this is a baseline feature, we added baseline metadata to establish the relationship between task_steps.signature_id and attachment.attachment_id. (On FSM Metadata screen, see the TASK_STEPS~PARENT02 Relationship ID.)