code: func NewHandler(caFile, caKeyFile string, policy *config.Signing) (http.Handler, error) {
  	root := universal.Root{
  		Config: map[string]string{
  			"cert-file": caFile,
  			"key-file":  caKeyFile,
  		},
  	}
  	s, err := universal.NewSigner(root, policy)
  	if err != nil {
  		log.Errorf("setting up signer failed: %v", err)
  		return nil, err
  	}
  
  	return signhandler.NewHandlerFromSigner(s)
  }
docs: // NewHandler generates a new Handler using the certificate
  // authority private key and certficate to sign certificates. If remote
  // is not an empty string, the handler will send signature requests to
  // the CFSSL instance contained in remote by default.