code: func (cl *Client) SignBlob(c context.Context, serviceAccount string, blob []byte) (keyName string, signature []byte, err error) {
  	var request struct {
  		BytesToSign []byte `json:"bytesToSign"`
  	}
  	request.BytesToSign = blob
  	var response struct {
  		KeyID     string `json:"keyId"`
  		Signature []byte `json:"signature"`
  	}
  	if err = cl.iamAPIRequest(c, "projects/-/serviceAccounts/"+serviceAccount, "signBlob", &request, &response); err != nil {
  		return "", nil, err
  	}
  	return response.KeyID, response.Signature, nil
  }
docs: // SignBlob signs a blob using a service account's system-managed key.
  //
  // The caller must have "roles/iam.serviceAccountTokenCreator" role in the
  // service account's IAM policy and caller's OAuth token must have one of the
  // scopes:
  //  * https://www.googleapis.com/auth/iam
  //  * https://www.googleapis.com/auth/cloud-platform
  //
  // Returns ID of the signing key and the signature on success.
  //
  // On API-level errors (e.g. insufficient permissions) returns *googleapi.Error.