code: func sign(key string, claims *ClaimSet) (string, error) {
  	b, err := json.Marshal(defaultHeader)
  	if err != nil {
  		return "", err
  	}
  	header := base64.RawURLEncoding.EncodeToString(b)
  
  	jsonClaims, err := json.Marshal(claims)
  	if err != nil {
  		return "", err
  	}
  	encodedClaims := strings.TrimRight(base64.URLEncoding.EncodeToString(jsonClaims), "=")
  
  	ss := fmt.Sprintf("%s.%s", header, encodedClaims)
  
  	mac := hmac.New(sha256.New, []byte(key))
  	mac.Write([]byte(ss))
  	signature := mac.Sum(nil)
  
  	return fmt.Sprintf("%s.%s", ss, base64.RawURLEncoding.EncodeToString(signature)), nil
  }
docs: // Sign the claim set with the shared secret
  // Result to be sent as assertion