How to sign manifest.json for safari push notifications using golang?

Question

What would be the correct way to sign a manifest.json file to be used for a safari push notification package?

func servePushPackage() func(w http.ResponseWriter, r *http.Request) {
    return func(w http.ResponseWriter, r *http.Request) {
        body, _ := ioutil.ReadAll(r.Body)
        fmt.Printf("servePushPackage() %s %s %s %s %v\n", r.Method, r.RequestURI, r.RemoteAddr, body, r.FormValue)

        buf := new(bytes.Buffer)

        // Create a new zip archive.
        z := zip.NewWriter(buf)

        // Build the website.json file
        websiteJson :=
`{
    "websiteName": "Test",
    "websitePushID": "web.example.test",
    "allowedDomains": ["https://example.com"],
    "urlFormatString": "https://example.com/%@",
    "authenticationToken": "19f8d7a6e9fb8a7f6d9330dabe",
    "webServiceURL": "https://example.com"
}`

        // Build the manifest.json
        manifestJson := "{"

        // Add the icon files to the archive and to the manifest
        .... snip ....

        // Complete the manifest
        manifestJson = fmt.Sprintf("%s\n\t\"website.json\":\"%x\"\n}", manifestJson, sha1.Sum([]byte(websiteJson)) )

        addFileToArchive(z, "website.json", []byte([]byte(websiteJson)))
        addFileToArchive(z, "manifest.json", []byte([]byte(manifestJson)))
        addFileToArchive(z, "signature", []byte([]byte("test test test")))

        // Make sure to check the error on Close.
        err := z.Close()
        if err != nil {
            panic(err)
        }

        // Successfully built the push package
        w.Header().Set("Content-type", "application/zip")
        w.Write(buf.Bytes())
    }
}

Note that this all works correctly, the only issue is safari reporting the following:

{"logs":["Signature verification of push package failed"]}

The apple documentation indicates this is a built in feature of PHP, but no such luck finding an equivalent in go:

In PHP, you can do this with the openssl_pkcs7_sign function...