Assume you have an dependency to an existing library that already provides osgi-metadata in it’s manifest
And now you need to add additional osgi-metadata.
I know that extracting, editing and updating the manifest works.
But I wonder if there is a osgi/bnd way. 
Maybe one that does not break signed jars?
Well, that depends on what you need.
Here you can use the -augment instruction, to sell to the resolver that a Bundle has something more. This will however not work at runtime.
I don’t know about a way of doing this, especially without breaking the signature (which is the point of a signature). What We usually do is, create a bnd project with the same name as the plugin you want to modify and basically do the same, as if you would create a bundle out of it. This can be done the with this: Wrapping Libraries to OSGi Bundles | bnd or as another example this: https://github.com/geckoprojects-org/org.gecko.search/blob/snapshot/org.apache.lucene.core/bnd.bnd
Please note that you have to make sure, that you repackage all the additonal things, that are not generated automatically by bnd (e.g. a plugin.xml. It is also useful to add all the original build dependencies of the bundle you want to replace on the build path, so bnd can calculate the correct package import versions (in this case you need to make sure that you don’t use the * in the Export declaration, as this would repackage all the packages on the buildpath in your bundle).
The may be some freaky ways, of augmenting at runtime via some hook for the framework, but I would try to avoid that.