func SignRS256(r *rsa.PrivateKey, data []byte) ([]byte, error) {
    h := sha256.New()
    h.Write(data)
    d := h.Sum(nil)
    return rsa.SignPKCS1v15(rand.Reader, r, crypto.SHA256, d)