code: func (p *x509Signer) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
  	signature, err := pkcs11helpers.Sign(p.ctx, p.session, p.objectHandle, p.keyType, digest, opts.HashFunc())
  	if err != nil {
  		return nil, err
  	}
  
  	if p.keyType == pkcs11helpers.ECDSAKey {
  		// Convert from the PKCS#11 format to the RFC 5480 format so that
  		// it can be used in a X.509 certificate
  		r := big.NewInt(0).SetBytes(signature[:len(signature)/2])
  		s := big.NewInt(0).SetBytes(signature[len(signature)/2:])
  		signature, err = asn1.Marshal(struct {
  			R, S *big.Int
  		}{R: r, S: s})
  		if err != nil {
  			return nil, fmt.Errorf("failed to convert signature to RFC 5480 format: %s", err)
  		}
  	}
  	return signature, nil
  }
docs: // Sign wraps pkcs11helpers.Sign. If the signing key is ECDSA then the signature
  // is converted from the PKCS#11 format to the RFC 5480 format. For RSA keys a
  // conversion step is not needed.