Rsa.PKCS1.sign does throw, and returns a Cstruct.t (not an option anymore)