aws cli kms sign