Sign now takes a x509.Certificate instead of bytes