This sounds similar to Ukrainian cash registers. Every retail operation goes through a cash register API on the tax agency side (because who would not love to keep some cash off the books, right), but there it is RESP+JSON and a cottage industry of services running it for you. It would not even be that hard is it wasn't sneaking the whole PKI into it.