To sign, you need to get the cert first from some 'ahem' source. When you get it, it will include the signer which on one view, you already know what to do.