code: func NewSigner(opts *KeyOptions) (Signer, error) {
  	privateKey := opts.KeyBytes
  	if opts.KeyPath != "" {
  		raw, err := ioutil.ReadFile(opts.KeyPath)
  		if err != nil {
  			return nil, err
  		}
  		privateKey = raw
  	}
  	block, _ := pem.Decode(privateKey)
  	blockBytes := block.Bytes
  	// Decode the PEM key if a password is set
  	if x509.IsEncryptedPEMBlock(block) {
  		b, err := x509.DecryptPEMBlock(block, opts.Password)
  		if err != nil {
  			return nil, err
  		}
  		blockBytes = b
  	}
  	parsed, err := x509.ParsePKCS8PrivateKey(blockBytes)
  	if err != nil {
  		return nil, err
  	}
  	privKey, ok := parsed.(*rsa.PrivateKey)
  	if !ok {
  		return nil, fmt.Errorf("unsupported private key")
  	}
  	return &rsaSigner{privKey: privKey}, nil
  }
docs: // NewSigner creates a new RSA backed Signer