func RSASignSHA1Digest(sha1Digest []byte, keyFile, passphrase string) ([]byte, error) {
	if len(sha1Digest) != sha1.Size {
		return nil, errDigestNotSH1
	}
	keyFileContent, err := ioutil.ReadFile(keyFile)
	if err != nil {
		return nil, fmt.Errorf("reading key file: %w", err)
	}
	block, _ := pem.Decode(keyFileContent)
	if block == nil {
		return nil, errNoPemBlock
	}
	blockData := block.Bytes
	if x509.IsEncryptedPEMBlock(block) {  
		if passphrase == "" {
			return nil, errNoPassphrase
		}
		var decryptedBlockData []byte
		decryptedBlockData, err = x509.DecryptPEMBlock(block, []byte(passphrase))  
		if err != nil {
			return nil, fmt.Errorf("decrypt private key PEM block: %w", err)
		}
		blockData = decryptedBlockData
	}
	priv, err := x509.ParsePKCS1PrivateKey(blockData)
	if err != nil {
		return nil, fmt.Errorf("parse PKCS1 private key: %w", err)
	}
	signature, err := priv.Sign(rand.Reader, sha1Digest, crypto.SHA1)
	if err != nil {
		return nil, fmt.Errorf("signing: %w", err)
	}
	return signature, nil
}
RSASignSHA1Digest signs the provided SHA1 message digest. The key file
must be in the PEM format and can either be encrypted or not.
package sign
import (
	"crypto"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha1"  
	"crypto/x509"
	"encoding/pem"
	"errors"
	"fmt"
	"io"
	"io/ioutil"
)
var (
	errNoPemBlock   = errors.New("no PEM block found")
	errDigestNotSH1 = errors.New("digest is not a SHA1 hash")
	errNoPassphrase = errors.New("key is encrypted but no passphrase was provided")
	errNoRSAKey     = errors.New("key is not an RSA key")
)