code: func SignToken(c context.Context, signer signing.Signer, subtok *messages.Subtoken) (string, error) {
  	s := tokensigning.Signer{
  		Signer:         signer,
  		SigningContext: tokenSigningContext,
  		Wrap: func(w *tokensigning.Unwrapped) proto.Message {
  			return &messages.DelegationToken{
  				SerializedSubtoken: w.Body,
  				Pkcs1Sha256Sig:     w.RsaSHA256Sig,
  				SignerId:           "user:" + w.SignerID,
  				SigningKeyId:       w.KeyID,
  			}
  		},
  	}
  	return s.SignToken(c, subtok)
  }
docs: // SignToken signs and serializes the delegation subtoken.
  //
  // It doesn't do any validation. Assumes the prepared subtoken is valid.
  //
  // Produces base64 URL-safe token or a transient error.