diff --git a/.gitignore b/.gitignore
index 6d48720ecef..f4d83484448 100644
--- a/.gitignore
+++ b/.gitignore
@@ -29,6 +29,8 @@ patches/**/*.patchinfo
 /third_party/rust/kuchiki/v0_8/crate
 /third_party/rust/futures_retry/v0_5/crate
 /third_party/rust/star_constellation/v0_2/crate
+/third_party/cryptography
+/third_party/macholib
 *.xcodeproj
 *.swp
 *.pyc
diff --git a/DEPS b/DEPS
index 337e5c68573..05b9722ec7c 100644
--- a/DEPS
+++ b/DEPS
@@ -40,7 +40,10 @@ deps = {
   "third_party/rust/futures_retry/v0_5/crate": "https://github.com/brave-intl/futures-retry.git@2aaaafbc3d394661534d4dbd14159d164243c20e",
   "third_party/rust/kuchiki/v0_8/crate": "https://github.com/brave/kuchiki.git@589eadca2c1d06ddda2919354590bfe1ace88a43",
   "third_party/rust/adblock/v0_7/crate": "https://github.com/brave/adblock-rust.git@444cde7f2be40e3725b13515d80aaff9e9a56987",
-
+  "third_party/macholib": {
+    "url": "https://github.com/ronaldoussoren/macholib.git@36a6777ccd0891c5d1b44ba885573d7c90740015",
+    "condition": "checkout_mac",
+  },
 }
 
 recursedeps = [
@@ -66,6 +69,26 @@ hooks = [
     'condition': 'checkout_mac and download_prebuilt_sparkle',
     'action': ['vpython3', 'build/mac/download_sparkle.py', '1.24.3'],
   },
+  {
+    'name': 'update_pip',
+    'pattern': '.',
+    # Required for download_cryptography below. Specifically, newer versions of
+    # pip are required for obtaining binary wheels on Arm64 macOS.
+    'action': ['python3', '-m', 'pip', '-q', '--disable-pip-version-check', 'install', '-U', 'pip'],
+  },
+  {
+    'name': 'download_cryptography',
+    'pattern': '.',
+    # We don't include cryptography as a DEP because building it from source is
+    # difficult. We pin to a version >=37.0.2 and <38.0.0 to avoid an
+    # incompatibility with our pyOpenSSL version on Android. See:
+    # https://github.com/pyca/cryptography/issues/7126.
+    # We use python3 instead of vpython3 for two reasons: First, our GN actions
+    # are run with python3, so this environment mirrors the one in which
+    # cryptography will be used. Second, we cannot update pip in vpython3 on at
+    # least macOS due to permission issues.
+    'action': ['python3', '-m', 'pip', '-q', '--disable-pip-version-check', 'install', '-U', '-t', 'third_party/cryptography', '--only-binary', 'cryptography', 'cryptography==37.0.4'],
+  },
   {
     'name': 'wireguard_nt',
     'pattern': '.',
diff --git a/browser/widevine/BUILD.gn b/browser/widevine/BUILD.gn
index 6fba27649d9..3b6f498b401 100644
--- a/browser/widevine/BUILD.gn
+++ b/browser/widevine/BUILD.gn
@@ -90,43 +90,16 @@ source_set("browser_tests") {
 }
 
 if (is_win && !skip_signing) {
-  template("sig_file") {
-    assert(defined(invoker.flags), "Need flags in $target_name.")
-    action(target_name) {
-      forward_variables_from(invoker,
-                             [
-                               "sources",
-                               "outputs",
-                               "deps",
-                             ])
-
-      # It would be nice to just invoke the original signature_generator.py
-      # script here. But it uses Python 2 and expects the `cryptography`
-      # library to be installed. So we invoke this Python 3 helper here.
-      script = "signature_generator_python3.py"
-      inputs = [
-        "//brave/script/lib/widevine.py",
-        "//brave/script/lib/util.py",
-        "//brave/script/lib/config.py",
-        "//brave/script/lib/env_util.py",
-      ]
-      args = [
-        rebase_path(sources[0], root_build_dir),
-        rebase_path(outputs[0], root_build_dir),
-        invoker.flags,
-      ]
-    }
-  }
-  sig_file("brave_exe_sig") {
+  widevine_sign_file("brave_exe_sig") {
+    file = "$root_out_dir/presigned_binaries/brave.exe"
+    signature_file = "$root_out_dir/brave.exe.sig"
     flags = "1"
-    sources = [ "$root_out_dir/presigned_binaries/brave.exe" ]
-    outputs = [ "$root_out_dir/brave.exe.sig" ]
     deps = [ "//brave:signed_brave_exe" ]
   }
-  sig_file("chrome_dll_sig") {
+  widevine_sign_file("chrome_dll_sig") {
+    file = "$root_out_dir/presigned_binaries/chrome.dll"
+    signature_file = "$root_out_dir/chrome.dll.sig"
     flags = "0"
-    sources = [ "$root_out_dir/presigned_binaries/chrome.dll" ]
-    outputs = [ "$root_out_dir/chrome.dll.sig" ]
     deps = [ "//brave:signed_chrome_dll" ]
   }
 }
diff --git a/browser/widevine/signature_generator_python3.py b/browser/widevine/signature_generator_python3.py
deleted file mode 100755
index b8e50437403..00000000000
--- a/browser/widevine/signature_generator_python3.py
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/usr/bin/env python3
-
-# Copyright (c) 2023 The Brave Authors. All rights reserved.
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0. If a copy of the MPL was not distributed with this file,
-# You can obtain one at https://mozilla.org/MPL/2.0/.
-
-from argparse import ArgumentParser
-
-from lib.widevine import generate_sig_file
-
-
-def main():
-    args = parse_args()
-    generate_sig_file(args.input_file, args.output_file, args.flags)
-
-
-def parse_args():
-    parser = ArgumentParser()
-    parser.add_argument('input_file')
-    parser.add_argument('output_file')
-    parser.add_argument('flags')
-    return parser.parse_args()
-
-
-if __name__ == '__main__':
-    main()
diff --git a/build/commands/lib/config.js b/build/commands/lib/config.js
index ac0763141ca..0b50f146436 100644
--- a/build/commands/lib/config.js
+++ b/build/commands/lib/config.js
@@ -1063,16 +1063,26 @@ Config.prototype.getCachePath = function () {
 Object.defineProperty(Config.prototype, 'defaultOptions', {
   get: function () {
     let env = Object.assign({}, process.env)
-    env = this.addPathToEnv(env, path.join(this.depotToolsDir, 'python-bin'), true)
-    env = this.addPathToEnv(env, path.join(this.depotToolsDir, 'python2-bin'), true)
-    env = this.addPathToEnv(env, path.join(this.srcDir, 'third_party', 'rust-toolchain', 'bin'), true)
+    env = this.addPathToEnv(env, path.join(this.depotToolsDir, 'python-bin'),
+                            true)
+    env = this.addPathToEnv(env, path.join(this.depotToolsDir, 'python2-bin'),
+                            true)
+    env = this.addPathToEnv(env, path.join(this.srcDir, 'third_party',
+                                           'rust-toolchain', 'bin'), true)
     env = this.addPathToEnv(env, this.depotToolsDir, true)
-    env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'brave', 'chromium_src', 'python_modules'))
-    env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'brave', 'script'))
-    env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'tools', 'grit', 'grit', 'extern'))
-    env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'brave', 'vendor', 'requests'))
-    env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'build'))
-    env = this.addPythonPathToEnv(env, path.join(this.srcDir, 'third_party', 'depot_tools'))
+    const pythonPaths = [
+      ['brave', 'chromium_src', 'python_modules'],
+      ['brave', 'script'],
+      ['tools', 'grit', 'grit', 'extern'],
+      ['brave', 'vendor', 'requests'],
+      ['brave', 'third_party', 'cryptography'],
+      ['brave', 'third_party', 'macholib'],
+      ['build'],
+      ['third_party', 'depot_tools'],
+    ]
+    pythonPaths.forEach(p => {
+      env = this.addPythonPathToEnv(env, path.join(this.srcDir, ...p))
+    })
     env.PYTHONUNBUFFERED = '1'
     env.TARGET_ARCH = this.gypTargetArch // for brave scripts
     env.RUSTUP_HOME = path.join(this.srcDir, 'third_party', 'rust-toolchain')
diff --git a/script/brave_license_helper.py b/script/brave_license_helper.py
index 29ec6cd8084..94dd3bba441 100644
--- a/script/brave_license_helper.py
+++ b/script/brave_license_helper.py
@@ -137,6 +137,17 @@ def AddBraveCredits(root, prune_paths, special_cases, prune_dirs,
             "URL": "https://github.com/brave/Sparkle",
             "License": "MIT",
         },
+        os.path.join('brave', 'third_party', 'cryptography'): {
+            "Name": "cryptography",
+            "URL": "https://cryptography.io",
+            "License": "Apache-2.0",
+            "License File": "/brave/common/licenses/Apache-2.0",
+        },
+        os.path.join('brave', 'third_party', 'macholib'): {
+            "Name": "macholib",
+            "URL": "https://github.com/ronaldoussoren/macholib",
+            "License": "MIT",
+        },
     })
 
     # Don't recurse into these directories looking for third-party code.
diff --git a/script/lib/widevine.py b/script/lib/widevine.py
index 1f8b83e8c95..e262e4679b4 100644
--- a/script/lib/widevine.py
+++ b/script/lib/widevine.py
@@ -6,6 +6,7 @@
 from os.path import dirname, realpath, join, exists
 
 import os
+import sys
 
 from lib.util import execute
 
@@ -24,12 +25,8 @@ def can_generate_sig_file():
 
 
 def generate_sig_file(input_file, output_file, flags):
-    # N.B.: We are invoking Python 2 below because signature_generator.py still
-    # uses it. It also expects the `cryptography` library to be pre-installed.
-    # We should migrate the script to Python 3 and use .vpython3 files to fetch
-    # the library instead.
     execute([
-        'python', SIGNATURE_GENERATOR_PY, '--input_file', input_file,
+        sys.executable, SIGNATURE_GENERATOR_PY, '--input_file', input_file,
         '--output_file', output_file, '--flags', flags, '--certificate',
         SIGN_WIDEVINE_CERT, '--private_key', SIGN_WIDEVINE_KEY,
         '--private_key_passphrase', SIGN_WIDEVINE_PASSPHRASE