code: func NewSigner(root Root, policy *config.Signing) (signer.Signer, error) {
  	if policy == nil {
  		policy = &config.Signing{
  			Profiles: map[string]*config.SigningProfile{},
  			Default:  config.DefaultConfig(),
  		}
  	}
  
  	if !policy.Valid() {
  		return nil, cferr.New(cferr.PolicyError, cferr.InvalidPolicy)
  	}
  
  	var s signer.Signer
  	var err error
  	if root.ForceRemote {
  		s, err = remote.NewSigner(policy)
  	} else {
  		if policy.NeedsLocalSigner() && policy.NeedsRemoteSigner() {
  			s, err = newUniversalSigner(root, policy)
  		} else {
  			if policy.NeedsLocalSigner() {
  				s, err = newLocalSigner(root, policy)
  			}
  			if policy.NeedsRemoteSigner() {
  				s, err = remote.NewSigner(policy)
  			}
  		}
  	}
  
  	return s, err
  }
docs: // NewSigner generates a new certificate signer from a Root structure.
  // This is one of two standard signers: local or remote. If the root
  // structure specifies a force remote, then a remote signer is created,
  // otherwise either a remote or local signer is generated based on the
  // policy. For a local signer, the CertFile and KeyFile need to be
  // defined in Root.