func (c *Claims) Sign(alg jose.SignatureAlgorithm, key interface{}) (string, error) {
	kid, err := GenerateKeyID(key)
	if err != nil {
		return "", err
	}
	so := new(jose.SignerOptions)
	so.WithType("JWT")
	so.WithHeader("kid", kid)
	for k, v := range c.ExtraHeaders {
		so.WithHeader(jose.HeaderKey(k), v)
	}
	signer, err := jose.NewSigner(jose.SigningKey{
		Algorithm: alg,
		Key:       key,
	}, so)
	if err != nil {
		return "", errors.Wrapf(err, "error creating JWT signer")
	}
	if len(c.Audience) == 1 {
		c.Set("aud", c.Audience[0])
	}
	raw, err := jose.Signed(signer).Claims(c.Claims).Claims(c.ExtraClaims).CompactSerialize()
	if err != nil {
		return "", errors.Wrapf(err, "error serializing JWT")
	}
	return raw, nil
}
Sign creates a JWT with the claims and signs it with the given key.
package token
import (
	"crypto"
	"encoding/base64"
	"time"
	"github.com/pkg/errors"
	"github.com/smallstep/cli/crypto/keys"
	"github.com/smallstep/cli/jose"
)
const (
	DefaultIssuer = "step-cli"
	DefaultAudience = "https://ca/sign"
	MinValidity = 10 * time.Second
	MaxValidity = 1 * time.Hour
	DefaultValidity = 5 * time.Minute
	MaxValidityDelay = 30 * time.Minute
)
const RootSHAClaim = "sha"
const SANSClaim = "sans"
const StepClaim = "step"
type Token interface {
	SignedString(sigAlg string, priv interface{}) (string, error)
}
type Claims struct {
	jose.Claims
	ExtraClaims  map[string]interface{}
	ExtraHeaders map[string]interface{}
}
func (c *Claims) Set(key string, value interface{}) {
	if c.ExtraClaims == nil {
		c.ExtraClaims = make(map[string]interface{})
	}
	c.ExtraClaims[key] = value
}
func (c *Claims) SetHeader(key string, value interface{}) {
	if c.ExtraHeaders == nil {
		c.ExtraHeaders = make(map[string]interface{})
	}
	c.ExtraHeaders[key] = value
}