Something like:

• Add a checkbox to Legalpad documents like "This document must be signed before user can log in to Phabricator."
• Add a flag to sessions like "this session has all the required documents signed".
• In PhabricatorController->willBeginExecution(), near the end, if:
  • the session does not have the flag;
  • the user is logged in;
  • legalpad is installed;
  • at least one signature-required document exists which the user has not signed;
  • the session is not partial; and
  • the controller does not have some shouldAllowLegallyNoncompliantUsers() flag, then
  • delegate to the signature controller.
• If all that stuff is true but they have the signatures, set the flag and continue.
• When the flag is added to a new document, wipe the flag off every active session to force them to check again.

Goal of this is to make the check only cost us once per session, instead of on every page.