code: func (sig *Signature) Serialize() []byte {
  	// low 'S' malleability breaker
  	sigS := sig.S
  	if sigS.Cmp(S256().halfOrder) == 1 {
  		sigS = new(big.Int).Sub(S256().N, sigS)
  	}
  	// Ensure the encoded bytes for the r and s values are canonical and
  	// thus suitable for DER encoding.
  	rb := canonicalizeInt(sig.R)
  	sb := canonicalizeInt(sigS)
  
  	// total length of returned signature is 1 byte for each magic and
  	// length (6 total), plus lengths of r and s
  	length := 6 + len(rb) + len(sb)
  	b := make([]byte, length)
  
  	b[0] = 0x30
  	b[1] = byte(length - 2)
  	b[2] = 0x02
  	b[3] = byte(len(rb))
  	offset := copy(b[4:], rb) + 4
  	b[offset] = 0x02
  	b[offset+1] = byte(len(sb))
  	copy(b[offset+2:], sb)
  	return b
  }
docs: // Serialize returns the ECDSA signature in the more strict DER format.  Note
  // that the serialized bytes returned do not include the appended hash type
  // used in Bitcoin signature scripts.
  //
  // encoding/asn1 is broken so we hand roll this output:
  //
  // 0x30 <length> 0x02 <length r> r 0x02 <length s> s