If none, will be random
:param signtext: (optional) make the checksum include different data than what
                 is encrypted. Useful for kerberos GSS_WrapEx. If none, same as
                 plaintext.
ú