I didn’t get any responses, I’m afraid. At the time, it wasn’t an immediately-pressing feature for us, so it got left aside to look at again later (in the meantime, we’re just using normal MODx manager user accounts for users who need them, as we only have a few users at present).
I think that the way to go forward would probably be:
1. Have a special page set up so that when the user accesses the page they are automatically requested to login with Cosign.
2. When the user is returned to the page after successful Cosign login, the page content would be a link to a MODx page.
3. When the user accesses the link to the MODx page, the MODx page would contain code which extracts the user’s Cosign identity and matches it up with the corresponding MODx identity.. (there’s something involving
gnomes and underpants involved here

)
4. ..and the above page then sets the user as being logged in.