code: public static byte []
  toDNS(DSAParams params, byte [] sig)
  throws SignatureException
  {
  	int rLength, sLength;
  	int rOffset, sOffset;
  	if ((sig[0] != ASN1_SEQ) || (sig[2] != ASN1_INT))
  		throw new SignatureException("Expected SEQ, INT");
  	rLength = sig[3];
  	rOffset = 4;
  	if (sig[rOffset] == 0) {
  		rLength--;
  		rOffset++;
  	}
  	if (sig[rOffset+rLength] != ASN1_INT)
  		throw new SignatureException("Expected INT");
  	sLength = sig[rOffset + rLength + 1];
  	sOffset = rOffset + rLength + 2;
  	if (sig[sOffset] == 0) {
  		sLength--;
  		sOffset++;
  	}
  
  	if ((rLength > 20) || (sLength > 20))
  		throw new SignatureException("DSA R/S too long");
  
  	byte[] newSig = new byte[41];
  	Arrays.fill(newSig, (byte) 0);
  	newSig[0] = (byte) ((params.getP().bitLength() - 512)/64);
  	System.arraycopy(sig, rOffset, newSig, 1 + (20 - rLength), rLength);
  	System.arraycopy(sig, sOffset, newSig, 21 + (20 - sLength), sLength);
  	return newSig;
  }
docs: Converts the signature generated by DSA signature routines to
  the one expected inside an RRSIG/SIG record.