Python 3.9 is now generally available.

google.appengine.api.app_identity.sign_blob

Signs a blob.

bytes_to_sign The blob that must be signed.
deadline Optional deadline in seconds for the operation; the default value is a system-specific deadline, typically 5 seconds.

A tuple containing the signing key name and signature.