code: func Sign(privKeyPEM []byte, data io.Reader) ([]byte, error) {
  	// Parse the private key
  	key, err := loadPrivateKey(privKeyPEM)
  	if err != nil {
  		return nil, err
  	}
  
  	// Hash the reader data
  	hash, err := hashReader(data)
  	if err != nil {
  		return nil, err
  	}
  
  	// Sign the hash
  	r, s, err := ecdsa.Sign(rand.Reader, key, hash)
  	if err != nil {
  		return nil, err
  	}
  
  	// Marshal the signature using ASN.1
  	sig, err := marshalSignature(r, s)
  	if err != nil {
  		return nil, err
  	}
  
  	// Encode it in a PEM block
  	bs := pem.EncodeToMemory(&pem.Block{
  		Type:  "SIGNATURE",
  		Bytes: sig,
  	})
  
  	return bs, nil
  }
docs: // Sign computes the hash of data and signs it with the private key, returning
  // a signature in PEM format.