code: func (ca *CertificateAuthorityImpl) noteSignError(err error) {
  	if err != nil {
  		if _, ok := err.(*pkcs11.Error); ok {
  			ca.stats.Inc(metricHSMError, 1)
  		} else if cfErr, ok := err.(*cferr.Error); ok {
  			ca.stats.Inc(fmt.Sprintf("%s.%d", metricSigningError, cfErr.ErrorCode), 1)
  		}
  	}
  	return
  }
docs: // noteSignError is called after operations that may cause a CFSSL
  // or PKCS11 signing error.