func (a *DIDSignatureHashAlgorithms) Verify(secret httpsignatures.Secret, data, signature []byte) error {
	verificationMethod, err := a.derefVerMethod(secret.KeyID, did.CapabilityDelegation)
	if err != nil {
		return fmt.Errorf("failed to dereference verificationMethod from didURL %s: %w", secret.KeyID, err)
	}
	keyType, err := kmsKeyType(verificationMethod)
	if err != nil {
		return fmt.Errorf("failed to map verificationMethod to a KMS keyType: %w", err)
	}
	kh, err := a.KMS.PubKeyBytesToHandle(verificationMethod.Value, keyType)
	if err != nil {
		return fmt.Errorf("failed to convert didURL %s pubkey to aries kms handle: %w", secret.KeyID, err)
	}
	err = a.Crypto.Verify(signature, data, kh)
	if err != nil {
		return fmt.Errorf("failed to verify signature: %w", err)
	}
	return nil
}
Verify the signature over data using the secret.
package zcapld
import (
	"fmt"
	"net/http"
	"strings"
	"github.com/hyperledger/aries-framework-go/pkg/doc/did"
	"github.com/hyperledger/aries-framework-go/pkg/doc/jose/jwk"
	"github.com/hyperledger/aries-framework-go/pkg/kms"
	"github.com/hyperledger/aries-framework-go/pkg/kms/localkms"
	"github.com/igor-pavlenko/httpsignatures-go"
	"github.com/trustbloc/edge-core/pkg/zcapld"
)
const signatureHashAlgorithm = "https://github.com/hyperledger/aries-framework-go/zcaps"
func NewHTTPSigner(
	verMethod, capability string, action func(*http.Request) (string, error), secrets httpsignatures.Secrets,
	algorithm httpsignatures.SignatureHashAlgorithm) func(*http.Request) (*http.Header, error) {
	return func(r *http.Request) (*http.Header, error) {
		hs := httpsignatures.NewHTTPSignatures(secrets)
		hs.SetSignatureHashAlgorithm(algorithm)
		a, err := action(r)
		if err != nil {
			return nil, fmt.Errorf("failed to determine invocation action for request: %w", err)
		}
		r.Header.Set(
			zcapld.CapabilityInvocationHTTPHeader,
			fmt.Sprintf(`zcap capability="%s",action="%s"`, capability, a),
		)
		err = hs.Sign(verMethod, r)
		if err != nil {
			return nil, fmt.Errorf("failed to sign request: %w", err)
		}
		return &r.Header, nil
	}
}
type DIDSecrets struct {
	Secrets map[string]httpsignatures.Secrets
}
func (c *DIDSecrets) Get(didURL string) (httpsignatures.Secret, error) {
	id, _, err := parseDIDURL(didURL)
	if err != nil {
		return httpsignatures.Secret{}, fmt.Errorf("failed to parse [%s]: %w", didURL, err)
	}
	secrets, supported := c.Secrets[id.Method]
	if !supported {
		return httpsignatures.Secret{}, fmt.Errorf("unsupported DID method: %s", id.Method)
	}
	secret, err := secrets.Get(didURL)
	if err != nil {
		return httpsignatures.Secret{}, fmt.Errorf("failed to fetch secret for method [%s]: %w", id.Method, err)
	}
	secret.Algorithm = signatureHashAlgorithm
	return secret, nil
}
type DIDSignatureHashAlgorithms struct {
	KMS       KMS
	Crypto    Crypto
	Resolvers []DIDResolver
}
func (a *DIDSignatureHashAlgorithms) Algorithm() string {
	return signatureHashAlgorithm
}
func (a *DIDSignatureHashAlgorithms) Create(secret httpsignatures.Secret, data []byte) ([]byte, error) {
	verificationMethod, err := a.derefVerMethod(secret.KeyID, did.CapabilityDelegation)
	if err != nil {
		return nil, fmt.Errorf("failed to dereference verificationMethod from didURL %s: %w", secret.KeyID, err)
	}
	keyType, err := kmsKeyType(verificationMethod)
	if err != nil {
		return nil, fmt.Errorf("failed to map verificationMethod to a KMS keyType: %w", err)
	}
	kid, err := localkms.CreateKID(verificationMethod.Value, keyType)
	if err != nil {
		return nil, fmt.Errorf("failed to create KID from didURL %s: %w", secret.KeyID, err)
	}
	kh, err := a.KMS.Get(kid)
	if err != nil {
		return nil, fmt.Errorf("failed to get key handle for kid %s: %w", kid, err)
	}
	sig, err := a.Crypto.Sign(data, kh)
	if err != nil {
		return nil, fmt.Errorf("failed to sign data: %w", err)
	}
	return sig, nil
}