code: func SignToken(c context.Context, signer signing.Signer, body *tokenserver.MachineTokenBody) (string, error) {
  	s := tokensigning.Signer{
  		Signer:         signer,
  		SigningContext: tokenSigningContext,
  		Encoding:       base64.RawStdEncoding,
  		Wrap: func(w *tokensigning.Unwrapped) proto.Message {
  			return &tokenserver.MachineTokenEnvelope{
  				TokenBody: w.Body,
  				RsaSha256: w.RsaSHA256Sig,
  				KeyId:     w.KeyID,
  			}
  		},
  	}
  	return s.SignToken(c, body)
  }
docs: // SignToken signs and serializes the machine subtoken.
  //
  // It doesn't do any validation. Assumes the prepared subtoken is valid.
  //
  // Produces base64-encoded token or a transient error.