We sell to Saudi merchants and ZATCA Phase 2 mandates UBL 2.1 XML, XAdES-BES digital signing, a PIH/ICV hash chain, and real-time clearance via their API. Building this in WooCommerce was surprisingly complex — especially the hash chain part where two simultaneous orders can corrupt the chain if you're not careful.
We ended up using a WordPress options-based spin-lock (50ms back-off) to prevent race conditions, and scheduling the ZATCA API call via WP-Cron with exponential retry (5min → 25min → 2h → 10h) so checkout stays fast.
Anyone else doing ZATCA compliance in WooCommerce? Curious how others handled the XAdES signing and hash chain — are you doing it sync or async?