crypto.go
func NewSigner(opts *KeyOptions) (Signer, error) {
	privateKey := opts.KeyBytes
	if opts.KeyPath != "" {
		raw, err := ioutil.ReadFile(opts.KeyPath)
		if err != nil {
			return nil, err
		}
		privateKey = raw
	}
	block, _ := pem.Decode(privateKey)
	blockBytes := block.Bytes
	// Decode the PEM key if a password is set
	if x509.IsEncryptedPEMBlock(block) {
		b, err := x509.DecryptPEMBlock(block, opts.Password)
		if err != nil {
			return nil, err
		}
		blockBytes = b
	}
	parsed, err := x509.ParsePKCS8PrivateKey(blockBytes)
	if err != nil {
		return nil, err
	}
	privKey, ok := parsed.(*rsa.PrivateKey)
	if !ok {
		return nil, fmt.Errorf("unsupported private key")
	}
	return &rsaSigner{privKey: privKey}, nil
}
func NewSigner(opts *KeyOptions) (Signer, error) {
	privateKey := opts.KeyBytes
	if opts.KeyPath != "" {
		raw, err := ioutil.ReadFile(opts.KeyPath)
		if err != nil {
			return nil, err
		}
		privateKey = raw
	}
	block, _ := pem.Decode(privateKey)
	blockBytes := block.Bytes
	// Decode the PEM key if a password is set
	if x509.IsEncryptedPEMBlock(block) {
		b, err := x509.DecryptPEMBlock(block, opts.Password)
		if err != nil {
			return nil, err
		}
		blockBytes = b
	}
	parsed, err := x509.ParsePKCS8PrivateKey(blockBytes)
	if err != nil {
		return nil, err
	}
	privKey, ok := parsed.(*rsa.PrivateKey)
	if !ok {
		return nil, fmt.Errorf("unsupported private key")
	}
	return &rsaSigner{privKey: privKey}, nil
}
// NewSigner creates a new RSA backed Signer