Rsa.PKCS1.sign does throw, and returns a Cstruct.t (not an option anymore)

catch-all errors is usually not a good idea (as it also catches SIGPIPE and hother stuff)