code: func SignPKCS1v15(rand io.Reader, priv *PrivateKey, hash crypto.Hash, hashed []byte) (s []byte, err error) {
  	hashLen, prefix, err := pkcs1v15HashInfo(hash, len(hashed))
  	if err != nil {
  		return
  	}
  
  	tLen := len(prefix) + hashLen
  	k := (priv.N.BitLen() + 7) / 8
  	if k < tLen+11 {
  		return nil, ErrMessageTooLong
  	}
  
  	// EM = 0x00 || 0x01 || PS || 0x00 || T
  	em := make([]byte, k)
  	em[1] = 1
  	for i := 2; i < k-tLen-1; i++ {
  		em[i] = 0xff
  	}
  	copy(em[k-tLen:k-hashLen], prefix)
  	copy(em[k-hashLen:k], hashed)
  
  	m := new(big.Int).SetBytes(em)
  	c, err := decryptAndCheck(rand, priv, m)
  	if err != nil {
  		return
  	}
  
  	copyWithLeftPad(em, c.Bytes())
  	s = em
  	return
  }
docs: // SignPKCS1v15 calculates the signature of hashed using RSASSA-PKCS1-V1_5-SIGN from RSA PKCS#1 v1.5.
  // Note that hashed must be the result of hashing the input message using the
  // given hash function. If hash is zero, hashed is signed directly. This isn't
  // advisable except for interoperability.
  //
  // If rand is not nil then RSA blinding will be used to avoid timing side-channel attacks.
  //
  // This function is deterministic. Thus, if the set of possible messages is
  // small, an attacker may be able to build a map from messages to signatures
  // and identify the signed messages. As ever, signatures provide authenticity,
  // not confidentiality.