code: func SignGrant(c context.Context, signer signing.Signer, tok *tokenserver.OAuthTokenGrantBody) (string, error) {
  	s := tokensigning.Signer{
  		Signer:         signer,
  		SigningContext: tokenSigningContext,
  		Wrap: func(w *tokensigning.Unwrapped) proto.Message {
  			return &tokenserver.OAuthTokenGrantEnvelope{
  				TokenBody:      w.Body,
  				Pkcs1Sha256Sig: w.RsaSHA256Sig,
  				KeyId:          w.KeyID,
  			}
  		},
  	}
  	return s.SignToken(c, tok)
  }
docs: // SignGrant signs and serializes the OAuth grant.
  //
  // It doesn't do any validation. Assumes the prepared body is valid.
  //
  // Produces base64 URL-safe token or a transient error.