This was previously proposed in #28427 but rejected. However, I don't think it was given proper consideration.

As mentioned in #28427, it is possible for a crypto.Signer to require remote calls to some external service such as AWS KMS. Currently the Sign method does not take a context.Context, meaning that the timeout/cancellation and any logging/monitoring metadata cannot make it across the method call. @bcmills mentioned using currying to simulate this but that does not work well with the crypto/tls API (and possibly others). Instead the desire there would be to forward the context from HandshakeContext across.

I propose the following changes. First add a new interface to crypto.

type ContextSigner interface {
	Signer
	SignContext(ctx context.Context, rand io.Reader, digest []byte, opts SignerOpts) (signature []byte, err error)
}

Then add a helper function to crypto. (Not strictly required but will make people's lives easier.)

func SignContext(ctx context.Context, s Signer, rand io.Reader, digest []byte, opts SignerOpts) (signature []byte, err error) {
    cs, ok := s.(ContextSigner)
    if !ok {
        return s.Sign(rand, digest, opts)
    }
    return cs.SignContext(ctx, rand, digest, opts)
}

Then the internals of net/tls can be amended to call the new crypto.SignContext function from HandshakeContext.