You can't sign a rental contract because eIDAS requires "mobile device security validation systems" and that's the only remaining way to sign documents, and once again the server uses attestation.
The server can be OSS, the app can be OSS, this kind of system could even use open protocols (e.g. OID...