Create a Google Cloud KMS-based signer

[johndayrichter]

Google Cloud projects should use Cloud KMS for digital signatures so that users do not have to generate or store private keys. Cloud KMS keeps them entirely secret, which should be the best practice for our system.

The relevant methods are documented here:

https://cloud.google.com/kms/docs/create-validate-signatures

And important caveats for JWTs are documented here:

• https://stackoverflow.com/questions/54250511/using-google-cloud-key-management-service-to-sign-json-web-tokens
• https://stackoverflow.com/questions/55828435/google-cloud-key-management-service-to-sign-json-web-tokens