Function generate_signature 

pub fn generate_signature(
    rng: &mut impl CryptoRng,
    message: &Message,
    epoch: u32,
) -> (XmssPublicKey, XmssSignature)

Generates a key and a signature on message at epoch, for witness generation.

The tree exists only along the authentication path. Its sibling nodes are drawn at random and the root is whatever climbing the path from the leaf produces, which is what the reference’s secret key does for every node outside the range of epochs it can sign — so a 2^32-leaf tree costs 32 hashes here rather than 2^32.

This is enough to exercise a verifier and no more: there is no secret key to sign with again, and no second epoch under the same root.