             throw Abort.custom(status: .internalServerError, message: "Failed to get rsa key.")
         }
         
-        self.key = .public(rsa)
-    }
-    
-    public func sign(message: Bytes) throws -> Bytes {
-        guard case .private(let cKey) = key else {
-            throw JWTError.privateKeyRequired
-        }
-        
-        var siglen: UInt32 = 0
-        var sig = Bytes(
-            repeating: 0,
-            count: Int(RSA_size(cKey))
-        )
-        
-        let digest = try Hash(hashMethod.method, message).hash()
-        
-        RSA_sign(
-            hashMethod.type,
-            digest,
-            UInt32(digest.count),
-            &sig,
-            &siglen,
-            cKey
-        )
-        
-        return sig
-    }
-    
-    public func verify(signature: Bytes, message: Bytes) throws {
-        let digest = try Hash(hashMethod.method, message).hash()
-        
-        let result = RSA_verify(
-            hashMethod.type,
-            digest,
-            UInt32(digest.count),
-            signature,
-            UInt32(signature.count),
-            key.cKey
-        )
-        
-        guard result == 1 else {
-            throw JWTError.signatureVerificationFailed
-        }
+        self.init(key: .public(rsa))
     }
 }
 


            let jwt = try JWT(token: token)
            let certificate = try self.fetchSigningKey(for: jwt.headers.extract("kid") as String)
            let signer = try Certificate_RS256(certificate: certificate)
            
            // TODO : IssuedAtClaim should be in the past
            let claims = [ExpirationTimeClaim(createTimestamp: { return Seconds(Date().timeIntervalSince1970) }, leeway: 60),

    init(subject: String, request: Request) throws
}

extension RSASigner {
    
    init(certificate: String) throws {
        let certificateBytes = certificate.bytes
