code: func SigningPolicy(certExpiry time.Duration) *cfconfig.Signing {
  	// Force the minimum Certificate expiration to be fifteen minutes
  	if certExpiry < MinNodeCertExpiration {
  		certExpiry = DefaultNodeCertExpiration
  	}
  
  	// Add the backdate
  	certExpiry = certExpiry + CertBackdate
  
  	return &cfconfig.Signing{
  		Default: &cfconfig.SigningProfile{
  			Usage:    []string{"signing", "key encipherment", "server auth", "client auth"},
  			Expiry:   certExpiry,
  			Backdate: CertBackdate,
  			// Only trust the key components from the CSR. Everything else should
  			// come directly from API call params.
  			CSRWhitelist: &cfconfig.CSRWhitelist{
  				PublicKey:          true,
  				PublicKeyAlgorithm: true,
  				SignatureAlgorithm: true,
  			},
  		},
  	}
  }
docs: // SigningPolicy creates a policy used by the signer to ensure that the only fields
  // from the remote CSRs we trust are: PublicKey, PublicKeyAlgorithm and SignatureAlgorithm.
  // It receives the duration a certificate will be valid for