func VerifySignedHeader(h http.Header, key *rsa.PublicKey) error {
	s := h.Get("Multipass-Signature")
	if s == "" {
		return ErrInvalidSignature
	}
	a, err := parseHeaderParams(s)
	if err != nil {
		return ErrInvalidSignature
	}
	if a["algo"] != DefaultAlgo {
		return ErrInvalidSignature
	}
	if a["digest"] != DefaultDigest {
		return ErrInvalidSignature
	}
	signature, err := base64.StdEncoding.DecodeString(a["signature"])
	if err != nil || len(signature) == 0 {
		return ErrInvalidSignature
	}
	headerToSign := make(http.Header)
	for _, k := range strings.Split(a["signed-headers"], ",") {
		headerToSign.Add(k, h.Get(k))
	}
	hashed := sha256.Sum256(ConcatonateHeader(headerToSign))
	if err := rsa.VerifyPSS(key, crypto.SHA256, hashed[:], signature, nil); err != nil {
		return err
	}
	return nil
}
VerifySignedHeader verifies the signed header with the given public key.
It returns an erros when the key with name "Multipass-Signature" is not set.
package multipass
import (
	"bytes"
	"crypto"
	"crypto/rand"
	"crypto/rsa"
	"crypto/sha256"
	"encoding/base64"
	"errors"
	"fmt"
	"mime"
	"net/http"
	"net/textproto"
	"sort"
	"strings"
)
const (
	DefaultDigest  = "SHA256"
	DefaultAlgo    = "RSASSA-PSS"
	DefaultKeySize = 2048
)
var (
	ErrInvalidSignature = errors.New("invalid signature")
)
func copyHeader(dst, src http.Header) {
	for k, vs := range src {
		for _, v := range vs {
			dst.Add(k, v)
		}
	}
}
func formatHeaderParams(params map[string]string) string {
	s := mime.FormatMediaType("a", params)
	if len(s) > 3 {
		s = s[3:]
	}
	return s
}
func parseHeaderParams(s string) (params map[string]string, err error) {
	_, params, err = mime.ParseMediaType("42; " + s)
	return params, err
}
func SignHeader(h http.Header, key *rsa.PrivateKey) error {
	rng := rand.Reader
	hashed := sha256.Sum256(ConcatonateHeader(h))
	signature, err := rsa.SignPSS(rng, key, crypto.SHA256, hashed[:], nil)
	if err != nil {
		return err
	}
	buf := new(bytes.Buffer)
	for k := range h {
		if buf.Len() > 0 {
			fmt.Fprint(buf, ",", k)
			continue
		}
		fmt.Fprint(buf, k)
	}
	params := map[string]string{
		"signed-headers": buf.String(),
		"algo":           DefaultAlgo,
		"digest":         DefaultDigest,
		"signature":      base64.StdEncoding.EncodeToString(signature),
	}
	h.Set("Multipass-Signature", formatHeaderParams(params))
	return nil
}