    protected function signDocument(\DOMDocument $document, $node)
    {
        $this->add509Cert($this->getCertificate()->getPublicKey()->getX509Certificate());
        $this->setCanonicalMethod(XMLSecurityDSig::EXC_C14N);
        $this->addReference($document->documentElement, XMLSecurityDSig::SHA1, array('http://www.w3.org/2000/09/xmldsig#enveloped-signature', XMLSecurityDSig::EXC_C14N), array('id_name' => 'ID'));

        $this->sign($this->getCertificate()->getPrivateKey());
        $this->insertSignature($document->firstChild, $node);
        $this->canonicalizeSignedInfo();
    }
The software does not verify, or incorrectly verifies, the cryptographic signature for data.