Prevent shelling out to KMS plugin for softkms

internal/cryptoutil/cryptoutil.go

@@ -29,7 +29,7 @@ type Attestor interface {
 // CreateSigner reads a key from a file with a given name or creates a signer
 // with the given kms and name uri.
 func CreateSigner(kms, name string, opts ...pemutil.Options) (crypto.Signer, error) {
-	if kms == "" {
+	if kms == "" || isSoftKMS(kms) {
 		s, err := pemutil.Read(name, opts...)
 		if err != nil {
 			return nil, err
@@ -43,6 +43,10 @@ func CreateSigner(kms, name string, opts ...pemutil.Options) (crypto.Signer, err
 	return newKMSSigner(kms, name)
 }
 
+func isSoftKMS(kms string) bool {
+	return strings.HasPrefix(strings.ToLower(strings.TrimSpace(kms)), "softkms")
+}
+
 // LoadCertificate returns a x509.Certificate from a kms or file
 func LoadCertificate(kms, certPath string) ([]*x509.Certificate, error) {
 	if kms == "" {