code: func (cl *Client) SignJWT(c context.Context, serviceAccount string, cs *ClaimSet) (keyName, signedJwt string, err error) {
  	blob, err := json.Marshal(cs)
  	if err != nil {
  		return "", "", err
  	}
  	var request struct {
  		Payload string `json:"payload"`
  	}
  	request.Payload = string(blob) // yep, this is JSON inside JSON
  	var response struct {
  		KeyID     string `json:"keyId"`
  		SignedJwt string `json:"signedJwt"`
  	}
  	if err = cl.iamAPIRequest(c, "projects/-/serviceAccounts/"+serviceAccount, "signJwt", &request, &response); err != nil {
  		return "", "", err
  	}
  	return response.KeyID, response.SignedJwt, nil
  }
docs: // SignJWT signs a claim set using a service account's system-managed key.
  //
  // It injects the key ID into the JWT header before singing. As a result, JWTs
  // produced by SignJWT are slightly faster to verify, because we know what
  // public key to use exactly and don't need to enumerate all active keys.
  //
  // It also checks the expiration time and refuses to sign claim sets with
  // 'exp' set to more than 1h from now. Otherwise it is similar to SignBlob.
  //
  // The caller must have "roles/iam.serviceAccountTokenCreator" role in the
  // service account's IAM policy and caller's OAuth token must have one of the
  // scopes:
  //  * https://www.googleapis.com/auth/iam
  //  * https://www.googleapis.com/auth/cloud-platform
  //
  // Returns ID of the signing key and the signed JWT on success.
  //
  // On API-level errors (e.g. insufficient permissions) returns *googleapi.Error.