Factored out token signing into separate service