docs: def sign(self, pkt, key):
          """
          Sign an IPsec (ESP or AH) packet with this algo.
  
          @param pkt:    a packet that contains a valid encrypted ESP or AH layer
          @param key:    the authentication key, a byte string
  
          @return: the signed packet
          """
          if not self.mac:
              return pkt
  
          mac = self.new_mac(key)
  
          if pkt.haslayer(ESP):
              mac.update(raw(pkt[ESP]))
              pkt[ESP].data += mac.finalize()[:self.icv_size]
  
          elif pkt.haslayer(AH):
              clone = zero_mutable_fields(pkt.copy(), sending=True)
              mac.update(raw(clone))
              pkt[AH].icv = mac.finalize()[:self.icv_size]
  
          return pkt