Function sign_ca_scope 

pub fn sign_ca_scope(
    config: &Config,
    ca_config: &CaConfig,
    source: &dyn RevocationSource,
) -> Result<SignedScope, String>

Produce a signed bundle for one CA scope from an already-resolved revocation source. Pure with respect to the filesystem for the bundle (does not write the .ahu); it does read the state store to derive the epoch.