             case "RS256": return msg.rsa_signature(HMACAlgorithm.SHA256, key: key_raw)
             case "RS384": return msg.rsa_signature(HMACAlgorithm.SHA384, key: key_raw)
             case "RS512": return msg.rsa_signature(HMACAlgorithm.SHA512, key: key_raw)
-                // TODO: support for RSASSA-PSS algorithms: "PS256", "PS384", and "PS512"
+            case "PS256": return msg.rsa_signature(HMACAlgorithm.SHA256, key: key_raw) // TODO: convert PS to RS key
+            case "PS384": return msg.rsa_signature(HMACAlgorithm.SHA384, key: key_raw)
+            case "PS512": return msg.rsa_signature(HMACAlgorithm.SHA512, key: key_raw)
             default:      return nil
             }
         }

    }

    func nacl_signature(key: NSData) -> String! {
        let sodium = Sodium()
        if let sig = sodium?.sign.signature(self, secretKey: key) {
            return sig.base64SafeUrlEncode()


        var sig = NSMutableData(length: digestlen)!
        var sigbytes = UnsafeMutablePointer<UInt8>(sig.mutableBytes) // or UnsafeMutablePointer<UInt8>.alloc(Int(digestLen)) ?
        var siglen: Int = digestlen

        // OSStatus SecKeyRawSign(key: SecKey!, padding: SecPadding, dataToSign: UnsafePointer<UInt8>, dataToSignLen: Int, sig: UnsafeMutablePointer<UInt8>, sigLen: UnsafeMutablePointer<Int>)
        let status = SecKeyRawSign(privkey!, padding, digestbytes, digestlen, sigbytes, &siglen)
        if status == errSecSuccess {
            // use siglen in/out parameter to set the actual lenght of sig
            sig.length = siglen
            return sig.base64SafeUrlEncode()
        }
        return nil
    }

    func rsa_verify(algorithm: HMACAlgorithm, signature: String, key: NSData) -> Bool {
        // key is pubkey, in raw format
        let pubkey: SecKey? = nil /// TODO: get the SecKey format of the (public) key
        let msgbytes = UnsafePointer<UInt8>(self.bytes)
        let msglen = CC_LONG(self.length)
