How to use the node-opcua-service-secure-channel.MessageSecurityMode.Sign function in node-opcua-service-secure-channel

private _get_security_options_for_OPN(): SecureMessageChunkManagerOptions | null {

        // install sign & sign-encrypt behavior
        if (this.securityMode === MessageSecurityMode.Sign || this.securityMode === MessageSecurityMode.SignAndEncrypt) {

            const cryptoFactory = this.messageBuilder.cryptoFactory;
            if (!cryptoFactory) {
                throw new Error("Internal Error");
            }
            assert(cryptoFactory, "ServerSecureChannelLayer must have a crypto strategy");
            assert(this.receiverPublicKeyLength >= 0);

            const receiverPublicKey = this.receiverPublicKey;
            if (!receiverPublicKey) {
                throw new Error("Invalid receiverPublicKey");
            }
            const options = {
                cipherBlockSize: this.receiverPublicKeyLength,
                plainBlockSize: this.receiverPublicKeyLength - cryptoFactory.blockPaddingSize,
                signatureLength: this.getSignatureLength(),

private _construct_security_header() {

        assert(this.hasOwnProperty("securityMode"));
        assert(this.hasOwnProperty("securityPolicy"));
        this.receiverCertificate = this.serverCertificate ? Buffer.from(this.serverCertificate) : null;

        let securityHeader = null;
        switch (this.securityMode) {
            case MessageSecurityMode.Sign:
            case MessageSecurityMode.SignAndEncrypt: {

                assert(this.securityPolicy !== SecurityPolicy.None);
                // get the thumbprint of the client certificate
                const thumbprint = this.receiverCertificate ? makeSHA1Thumbprint(this.receiverCertificate) : null;
                securityHeader = new AsymmetricAlgorithmSecurityHeader({
                    receiverCertificateThumbprint: thumbprint,       // thumbprint of the public key used to encrypt the message
                    securityPolicyUri: toURI(this.securityPolicy),
                    senderCertificate: this.getCertificateChain()  // certificate of the private key used to sign the message
                });

                break;
            }
            default:
                /* istanbul ignore next */
                assert(false, "invalid security mode");

// receiverCertificateThumbprint:
        //    The thumbprint of the X509v3 certificate assigned to the receiving application
        //    The thumbprint is the SHA1 digest of the DER encoded form of the certificate.
        //    This indicates what public key was used to encrypt the MessageChunk
        //   This field shall be null if the message is not encrypted.
        switch (request.securityMode) {

            case MessageSecurityMode.None:
                securityHeader = new AsymmetricAlgorithmSecurityHeader({
                    receiverCertificateThumbprint: null, // message not encrypted
                    securityPolicyUri: "http://opcfoundation.org/UA/SecurityPolicy#None",
                    senderCertificate: null // message not signed
                });

                break;
            case MessageSecurityMode.Sign:
            case MessageSecurityMode.SignAndEncrypt:
            default: {
                // get the thumbprint of the client certificate
                const thumbprint = this.receiverCertificate
                    ? makeSHA1Thumbprint(this.receiverCertificate)
                    : null;

                if (!this.clientSecurityHeader) {
                    throw new Error("Internal");
                }
                const asymmClientSecurityHeader = this.clientSecurityHeader as AsymmetricAlgorithmSecurityHeader;

                securityHeader = new AsymmetricAlgorithmSecurityHeader({
                    receiverCertificateThumbprint: thumbprint, // message not encrypted (????)
                    securityPolicyUri: asymmClientSecurityHeader.securityPolicyUri,
                    senderCertificate: this.getCertificateChain() // certificate of the private key used to sign the message

endpoint = endpoints.filter(function (e) {
            return e.securityMode === MessageSecurityMode.Sign;
        });
    }