def _make_signature(self, header_b64, payload_b64, signing_key):
        """
        Sign a serialized header and payload.
        Return the urlsafe-base64-encoded signature.
        """
        token_segments = [header_b64, payload_b64]
        signing_input = b'.'.join(token_segments)

        signer = self._get_signer(signing_key)
        signer.update(signing_input)
        signature = signer.finalize()

        raw_signature = der_to_raw_signature(signature, signing_key.curve)
        return base64url_encode(raw_signature)