code: func (s *Signer) SignToken(c context.Context, body proto.Message) (string, error) {
  	info, err := s.Signer.ServiceInfo(c)
  	if err != nil {
  		return "", transient.Tag.Apply(err)
  	}
  	blob, err := proto.Marshal(body)
  	if err != nil {
  		return "", err
  	}
  	withCtx := prependSigningContext(blob, s.SigningContext)
  	keyID, sig, err := s.Signer.SignBytes(c, withCtx)
  	if err != nil {
  		return "", transient.Tag.Apply(err)
  	}
  	tok, err := proto.Marshal(s.Wrap(&Unwrapped{
  		Body:         blob,
  		RsaSHA256Sig: sig,
  		SignerID:     info.ServiceAccountName,
  		KeyID:        keyID,
  	}))
  	if err != nil {
  		return "", err
  	}
  	enc := s.Encoding
  	if enc == nil {
  		enc = base64.RawURLEncoding
  	}
  	return enc.EncodeToString(tok), nil
  }
docs: // SignToken serializes the body, signs it and returns serialized envelope.
  //
  // Produces base64 URL-safe token or an error (possibly transient).