title: Signed url for gcp bucket object fails with access denied
body: <p>As I generate a signed download url with a service account for an object within a storage gcp bucket, I expect it to be usable by anyone without authentication. However, I keep getting &quot;Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object&quot;. What am I doing wrong?</p>
  <pre><code>url, err := gcs.SignedURL(bktName, so.Name(), &amp;gcs.SignedURLOptions{
      GoogleAccessID: serviceAccountName,
      Method:         &quot;GET&quot;,
      Expires:        time.Now().Add(duration),
      ContentType:    md.RenditionMetadata[0].ContentType,
      Headers:        []string{fmt.Sprintf(&quot;x-goog-meta-filename: %s&quot;, md.RenditionMetadata[0].FileName)},
      SignBytes: func(b []byte) ([]byte, error) {
          signedBlob, err := iam.SignBlob(s.GoogleIamService(), serviceAccountName, b)
          if err != nil {
              return nil, err
          }
          return []byte(signedBlob), err
      },
  })
  </code></pre>
  <p>The service account I'm using has Storage Object Creator and Storage Object Viewer roles ...</p>