Rsa.PKCS1.sign does throw, and returns a Cstruct.t (not an option anymore)

yes, it is gone... sorry for the noise... we now fail rather earlier -- in config.ml during startup :)