code: func Sign(m *Manifest, pk libtrust.PrivateKey) (*SignedManifest, error) {
  	p, err := json.MarshalIndent(m, "", "   ")
  	if err != nil {
  		return nil, err
  	}
  
  	js, err := libtrust.NewJSONSignature(p)
  	if err != nil {
  		return nil, err
  	}
  
  	if err := js.Sign(pk); err != nil {
  		return nil, err
  	}
  
  	pretty, err := js.PrettySignature("signatures")
  	if err != nil {
  		return nil, err
  	}
  
  	return &SignedManifest{
  		Manifest:  *m,
  		all:       pretty,
  		Canonical: p,
  	}, nil
  }
docs: // Sign signs the manifest with the provided private key, returning a
  // SignedManifest. This typically won't be used within the registry, except
  // for testing.