code: func (rca *RootCA) Signer() (*LocalSigner, error) {
  	if rca.Pool == nil || rca.signer == nil || len(rca.signer.Cert) == 0 || rca.signer.Signer == nil {
  		return nil, ErrNoValidSigner
  	}
  
  	return rca.signer, nil
  }
docs: // Signer is an accessor for the local signer that returns an error if this root cannot sign.