let rs256_sign ~key ~data =
  (* Taken from https://github.com/mmaker/ocaml-letsencrypt *)
  let data = Cstruct.of_string data in
  let h = Mirage_crypto.Hash.SHA256.digest data in
  let pkcs1_digest = X509.Certificate.encode_pkcs1_digest_info (`SHA256, h) in
  Mirage_crypto_pk.Rsa.PKCS1.sig_encode ~key pkcs1_digest |> Cstruct.to_string