Function sign_rsa_pss 

pub fn sign_rsa_pss(
    key: &HsmKeyPair,
    digest: &[u8],
    hash_algorithm: RsaHashAlgorithm,
) -> HsmResult<Vec<u8>>

Sign with RSA-PSS.

Uses the standard PKCS#11 CKM_SHA*_RSA_PKCS_PSS mechanism which performs hashing and PSS padding internally. The digest parameter is the raw TBS (to-be-signed) data — the HSM hashes it.

The salt length is set equal to the hash output length, matching the CA/B Forum Baseline Requirements recommendation.