Rsa.PKCS1.sign does throw, and returns a Cstruct.t (not an option anymore)
fail if provided certificate is smaller than min_rsa_key_size
if PKCS1.sign fails, we've failed way earlier...
Merge pull request #209 from mirleft/nocrypto-api-change

Rsa.PKCS1.sign does throw, and returns a Cstruct.t (not an option anymore)