code: func iamSigner(c context.Context, actAs string) (*signer, error) {
  	t, err := auth.GetRPCTransport(c, auth.AsSelf, auth.WithScopes(iam.OAuthScope))
  	if err != nil {
  		return nil, errors.Annotate(err, "failed to grab RPC transport").Err()
  	}
  	s := &iam.Signer{
  		Client:         &iam.Client{Client: &http.Client{Transport: t}},
  		ServiceAccount: actAs,
  	}
  	return &signer{
  		Email:     actAs,
  		SignBytes: s.SignBytes,
  	}, nil
  }
docs: // iamSigner uses SignBytes IAM API for signing.