Using KMS instead of a X.509 key pair for SP

[OscarVanL]

Hi,

Is it possible to use a custom method for signing keys such as KMS (e.g: https://cloud.google.com/kms/docs/create-validate-signatures) instead of using a X.509 key pair. The motivation is I'd like to avoid the private key ever being on my service.

Does the library support something like this?

Thank you!