How to buy a X.509 certificate for signing digital payloads

Start with a Client authentication certificate which probably is good enough. You have two options:

1) Buy an email certificate. These are also client certificates and allow signing and are cheap.

2) Get a free server certificate from Letsencrypt. These come with the extensions below that might be good enough for your use case:

    X509v3 extensions:
        X509v3 Key Usage: critical
            Digital Signature, Key Encipherment
        X509v3 Extended Key Usage: 
            TLS Web Server Authentication, TLS Web Client Authentication
        X509v3 Basic Constraints: critical

The only challenge for these is that you need to own a valid domain to request them. The good news is that the ceritificate is for free