func (s *KMSSigner) Sign(rand io.Reader, digest []byte, opts crypto.SignerOpts) ([]byte, error) {
	response, err := s.client.Sign(&kms.SignInput{
		KeyId:            &s.key,
		Message:          digest,
		MessageType:      aws.String(kms.MessageTypeDigest),
		SigningAlgorithm: aws.String(kms.SigningAlgorithmSpecRsassaPkcs1V15Sha256),
	})
	if err != nil {
		return nil, err
	}
	return response.Signature, nil
}
Sign a digest with the private key in KMS
package signer
import (
	"crypto"
	"crypto/x509"
	"fmt"
	"io"
	"github.com/aws/aws-sdk-go/aws"
	"github.com/aws/aws-sdk-go/aws/session"
	"github.com/aws/aws-sdk-go/service/kms"
	"github.com/aws/aws-sdk-go/service/kms/kmsiface"
)
type KMSSigner struct {
	crypto.Signer
	client kmsiface.KMSAPI
	key    string
}
func NewKMSSigner(key string) *KMSSigner {
	sess := session.Must(session.NewSession())
	return &KMSSigner{
		key:    key,
		client: kms.New(sess),
	}
}
func (s *KMSSigner) Public() crypto.PublicKey {
	response, err := s.client.GetPublicKey(&kms.GetPublicKeyInput{
		KeyId: &s.key,
	})
	if err != nil {
		fmt.Printf(err.Error())
		return nil
	}
	publicKey, err := x509.ParsePKIXPublicKey(response.PublicKey)
	if err != nil {
		fmt.Printf(err.Error())
		return nil
	}
	return publicKey
}