code: func (ctx *SigningContext) SignString(content string) ([]byte, error) {
  	hash := ctx.Hash.New()
  	if ln, err := hash.Write([]byte(content)); err != nil {
  		return nil, fmt.Errorf("error calculating hash: %v", err)
  	} else if ln < 1 {
  		return nil, fmt.Errorf("zero length hash")
  	}
  	digest := hash.Sum(nil)
  
  	var signature []byte
  	if key, _, err := ctx.KeyStore.GetKeyPair(); err != nil {
  		return nil, fmt.Errorf("unable to fetch key for signing: %v", err)
  	} else if signature, err = rsa.SignPKCS1v15(rand.Reader, key, ctx.Hash, digest); err != nil {
  		return nil, fmt.Errorf("error signing: %v", err)
  	}
  	return signature, nil
  }
docs: // Useful for signing query string (including DEFLATED AuthnRequest) when
  // using HTTP-Redirect to make a signed request.
  // See 3.4.4.1 DEFLATE Encoding of https://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf