diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2dd3990..805a678 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,11 @@
 
 ## [Unreleased]
 
+### Added
+- `public::rsa` now supports RSA-PKCS1v1.5 signing (behind the `rsa-pkcs1v15`
+  feature flag).
+
+### Fixed
 - `build.rs` no longer respects `$GOPATH`, instead it always uses the
   `go.mod` from the vendored boringssl.
 
diff --git a/Cargo.toml b/Cargo.toml
index 2a67dec..8278cbc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -32,6 +32,7 @@
 insecure = []
 kdf = []
 rand-bytes = []
+rsa-pkcs1v15 = []
 experimental-sha512-ec = []
 # Run the `boringssl/test_symbol_conflict.sh` test during `cargo test`. This is
 # disabled by default because the test takes a long time to run.
diff --git a/boringssl/bindgen.sh b/boringssl/bindgen.sh
index 23fb135..a8262b8 100755
--- a/boringssl/bindgen.sh
+++ b/boringssl/bindgen.sh
@@ -98,9 +98,11 @@
 RSA_marshal_private_key|\
 RSA_new|\
 RSA_parse_private_key|\
+RSA_sign|\
 RSA_sign_pss_mgf1|\
 RSA_size|\
 RSA_up_ref|\
+RSA_verify|\
 RSA_verify_pss_mgf1|\
 SHA1_Init|\
 SHA1_Update|\
diff --git a/boringssl/boringssl.rs b/boringssl/boringssl.rs
index 14844a1..2617bae 100644
--- a/boringssl/boringssl.rs
+++ b/boringssl/boringssl.rs
@@ -1014,6 +1014,17 @@
     ) -> ::std::os::raw::c_int;
 }
 extern "C" {
+    #[link_name = "__RUST_MUNDANE_0_3_0_RSA_sign"]
+    pub fn RSA_sign(
+        hash_nid: ::std::os::raw::c_int,
+        in_: *const u8,
+        in_len: ::std::os::raw::c_uint,
+        out: *mut u8,
+        out_len: *mut ::std::os::raw::c_uint,
+        rsa: *mut RSA,
+    ) -> ::std::os::raw::c_int;
+}
+extern "C" {
     #[link_name = "__RUST_MUNDANE_0_3_0_RSA_sign_pss_mgf1"]
     pub fn RSA_sign_pss_mgf1(
         rsa: *mut RSA,
@@ -1028,6 +1039,17 @@
     ) -> ::std::os::raw::c_int;
 }
 extern "C" {
+    #[link_name = "__RUST_MUNDANE_0_3_0_RSA_verify"]
+    pub fn RSA_verify(
+        hash_nid: ::std::os::raw::c_int,
+        msg: *const u8,
+        msg_len: usize,
+        sig: *const u8,
+        sig_len: usize,
+        rsa: *mut RSA,
+    ) -> ::std::os::raw::c_int;
+}
+extern "C" {
     #[link_name = "__RUST_MUNDANE_0_3_0_RSA_verify_pss_mgf1"]
     pub fn RSA_verify_pss_mgf1(
         rsa: *mut RSA,
diff --git a/src/boringssl/mod.rs b/src/boringssl/mod.rs
index 70b6d12..4ae02f6 100644
--- a/src/boringssl/mod.rs
+++ b/src/boringssl/mod.rs
@@ -112,6 +112,8 @@
     RAND_bytes, RSA_bits, RSA_generate_key_ex, RSA_marshal_private_key, RSA_parse_private_key,
     RSA_sign_pss_mgf1, RSA_size, RSA_verify_pss_mgf1, SHA384_Init,
 };
+#[cfg(feature = "rsa-pkcs1v15")]
+use boringssl::raw::{RSA_sign, RSA_verify};
 
 impl CStackWrapper<BIGNUM> {
     /// The `BN_set_u64` function.
@@ -612,6 +614,45 @@
     }
 }
 
+/// The `RSA_sign` function.
+///
+/// # Panics
+///
+/// `rsa_sign` panics if `sig` is shorter than the minimum required signature
+/// size given by `rsa_size`.
+#[cfg(feature = "rsa-pkcs1v15")]
+pub fn rsa_sign(
+    hash_nid: c_int,
+    digest: &[u8],
+    sig: &mut [u8],
+    key: &CHeapWrapper<RSA>,
+) -> Result<usize, BoringError> {
+    unsafe {
+        // If we call RSA_sign with sig.len() < min_size, it will invoke UB.
+        let min_size = key.rsa_size().unwrap_abort();
+        assert_abort!(sig.len() >= min_size.get());
+
+        let mut sig_len: c_uint = 0;
+        RSA_sign(
+            hash_nid,
+            digest.as_ptr(),
+            digest.len().try_into().unwrap_abort(),
+            sig.as_mut_ptr(),
+            &mut sig_len,
+            // RSA_sign does not mutate its argument but, for
+            // backwards-compatibility reasons, continues to take a normal
+            // (non-const) pointer.
+            key.as_const() as *mut _,
+        )?;
+
+        // RSA_sign guarantees that it only needs RSA_size bytes for the
+        // signature.
+        let sig_len = sig_len.try_into().unwrap_abort();
+        assert_abort!(sig_len <= min_size.get());
+        Ok(sig_len)
+    }
+}
+
 /// The `rsa_sign_pss_mgf1` function.
 #[must_use]
 pub fn rsa_sign_pss_mgf1(
@@ -647,6 +688,25 @@
     }
 }
 
+/// The `RSA_verify` function.
+#[must_use]
+#[cfg(feature = "rsa-pkcs1v15")]
+pub fn rsa_verify(hash_nid: c_int, digest: &[u8], sig: &[u8], key: &CHeapWrapper<RSA>) -> bool {
+    unsafe {
+        RSA_verify(
+            hash_nid,
+            digest.as_ptr(),
+            digest.len(),
+            sig.as_ptr(),
+            sig.len(),
+            // RSA_verify does not mutate its argument but, for
+            // backwards-compatibility reasons, continues to take a normal
+            // (non-const) pointer.
+            key.as_const() as *mut _,
+        )
+    }
+}
+
 /// The `RSA_verify_pss_mgf1` function.
 #[must_use]
 pub fn rsa_verify_pss_mgf1(
diff --git a/src/boringssl/raw.rs b/src/boringssl/raw.rs
index eb0ac02..9ac8fd7 100644
--- a/src/boringssl/raw.rs
+++ b/src/boringssl/raw.rs
@@ -392,6 +392,20 @@
     ptr_or_err("RSA_parse_private_key", ffi::RSA_parse_private_key(cbs))
 }
 
+#[cfg(feature = "rsa-pkcs1v15")]
+#[allow(non_snake_case)]
+#[must_use]
+pub unsafe fn RSA_sign(
+    hash_nid: c_int,
+    in_: *const u8,
+    in_len: c_uint,
+    out: *mut u8,
+    out_len: *mut c_uint,
+    key: *mut RSA,
+) -> Result<(), BoringError> {
+    one_or_err("RSA_sign", ffi::RSA_sign(hash_nid, in_, in_len, out, out_len, key))
+}
+
 #[allow(non_snake_case)]
 #[must_use]
 pub unsafe fn RSA_sign_pss_mgf1(
@@ -418,6 +432,25 @@
         .ok_or_else(|| BoringError::consume_stack("RSA_size"))
 }
 
+#[cfg(feature = "rsa-pkcs1v15")]
+#[allow(non_snake_case)]
+#[must_use]
+pub unsafe fn RSA_verify(
+    hash_nid: c_int,
+    msg: *const u8,
+    msg_len: usize,
+    sig: *const u8,
+    sig_len: usize,
+    rsa: *mut RSA,
+) -> bool {
+    match ffi::RSA_verify(hash_nid, msg, msg_len, sig, sig_len, rsa) {
+        0 => false,
+        1 => true,
+        // RSA_verify promises to only return 0 or 1
+        _ => unreachable_abort!(),
+    }
+}
+
 #[allow(non_snake_case)]
 #[must_use]
 pub unsafe fn RSA_verify_pss_mgf1(
diff --git a/src/insecure.rs b/src/insecure.rs
index ef255b3..e4384ef 100644
--- a/src/insecure.rs
+++ b/src/insecure.rs
@@ -7,8 +7,8 @@
 //! WARNING: INSECURE CRYPTOGRAPHIC OPERATIONS.
 //!
 //! This module contains cryptographic operations which are considered insecure.
-//! These operations should only be used for compatibility with legacy systems,
-//! but never in new systems!
+//! These operations should only be used for compatibility with legacy systems -
+//! never in new systems!
 
 #![deprecated(note = "insecure cryptographic operations")]
 
diff --git a/src/lib.rs b/src/lib.rs
index de94f73..62583f4 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -26,17 +26,18 @@
 //!
 //! **Features**
 //!
-//! | Name         | Description              |
-//! | ------------ | ------------------------ |
-//! | `kdf`        | Key derivation functions |
-//! | `rand-bytes` | Generate random bytes    |
+//! | Name           | Description              |
+//! | -------------- | ------------------------ |
+//! | `kdf`          | Key derivation functions |
+//! | `rand-bytes`   | Generate random bytes    |
+//! | `rsa-pkcs1v15` | RSA-PKCS1v1.5 signatures |
 //!
 //! # Insecure Operations
 //!
 //! Mundane supports one additional feature not listed in the previous section:
 //! `insecure`. This enables some cryptographic primitives which are today
 //! considered insecure. These should only be used for compatibility with legacy
-//! systems, but never in new systems! When the `insecure` feature is used, an
+//! systems - never in new systems! When the `insecure` feature is used, an
 //! `insecure` module is added to the crate root. All insecure primitives are
 //! exposed through this module.
 
diff --git a/src/public/rsa/mod.rs b/src/public/rsa/mod.rs
index 991db95..e32d0c2 100644
--- a/src/public/rsa/mod.rs
+++ b/src/public/rsa/mod.rs
@@ -359,15 +359,49 @@
 /// An `RsaSignatureScheme` defines how to compute an RSA signature. The primary
 /// detail defined by a signature scheme is how to perform padding.
 ///
-/// `RsaSignatureScheme` is implemented by [`RsaPss`].
+/// `RsaSignatureScheme` is implemented by [`RsaPss`] and, if the `rsa-pkcs1v15`
+/// feature is enabled, [`RsaPkcs1v15`].
 pub trait RsaSignatureScheme:
     Sized + Copy + Clone + Default + Display + Debug + self::inner::RsaSignatureScheme
 {
 }
 
-/// The RSA-PSS signature scheme.
+/// The RSA-PKCS1v1.5 signature scheme.
+///
+/// This signature scheme is old, and considered less secure than RSA-PSS. It
+/// should only be used for compatibility with legacy systems - never in new
+/// systems!
+#[cfg(feature = "rsa-pkcs1v15")]
 #[derive(Copy, Clone, Default, Debug, Eq, PartialEq, Hash)]
-pub struct RsaPss;
+pub struct RsaPkcs1v15;
+
+#[cfg(feature = "rsa-pkcs1v15")]
+impl Display for RsaPkcs1v15 {
+    fn fmt(&self, f: &mut Formatter) -> Result<(), fmt::Error> {
+        write!(f, "RSA-PKCS1v1.5")
+    }
+}
+
+#[cfg(feature = "rsa-pkcs1v15")]
+impl Sealed for RsaPkcs1v15 {}
+#[cfg(feature = "rsa-pkcs1v15")]
+impl RsaSignatureScheme for RsaPkcs1v15 {}
+
+#[cfg(feature = "rsa-pkcs1v15")]
+impl self::inner::RsaSignatureScheme for RsaPkcs1v15 {
+    fn sign<B: RsaKeyBits, H: Hasher>(
+        rsa: &RsaKey<B>,
+        digest: &[u8],
+        sig: &mut [u8],
+    ) -> Result<usize, BoringError> {
+        // NOTE: rsa_sign will panic if sig is not large enough to hold the
+        // largest possible signature, as RSA_sign has this as a precondition.
+        boringssl::rsa_sign(H::nid(), digest, sig, &rsa.key)
+    }
+    fn verify<B: RsaKeyBits, H: Hasher>(rsa: &RsaKey<B>, digest: &[u8], sig: &[u8]) -> bool {
+        boringssl::rsa_verify(H::nid(), digest, sig, &rsa.key)
+    }
+}
 
 impl Display for RsaPss {
     fn fmt(&self, f: &mut Formatter) -> Result<(), fmt::Error> {
@@ -375,6 +409,10 @@
     }
 }
 
+/// The RSA-PSS signature scheme.
+#[derive(Copy, Clone, Default, Debug, Eq, PartialEq, Hash)]
+pub struct RsaPss;
+
 impl Sealed for RsaPss {}
 impl RsaSignatureScheme for RsaPss {}
 
@@ -384,9 +422,12 @@
         digest: &[u8],
         sig: &mut [u8],
     ) -> Result<usize, BoringError> {
-        // This is not needed for memory safety, but is an important security
-        // and correctness check, as passing a too-short signature would result
-        // in the signature being truncated.
+        // We assert here (and not in the RSA-PKCS1v1.5 implementation) because,
+        // while our rsa_sign wrapper (which implements PKCS1v1.5) performs this
+        // assertion itself (for safety reasons), our rsa_sign_pss_mgf1 wrapper
+        // does not. This assertion is an important security and correctness
+        // check as well, as passing a too-short signature would result in the
+        // signature being truncated.
         assert!(sig.len() >= rsa.key.rsa_size().unwrap().get());
         // A salt_len of -1 means to use a salt of the same length as the hash
         // output. This is a reasonable default and, for bit lengths larger than
@@ -567,6 +608,13 @@
                 unwrap_pub_any(RsaPubKeyAnyBits::parse_from_der(&pubkey.marshal_to_der()).unwrap());
 
             fn sign_and_verify<B: RsaKeyBits>(privkey: &RsaPrivKey<B>, pubkey: &RsaPubKey<B>) {
+                #[cfg(feature = "rsa-pkcs1v15")]
+                {
+                    let sig =
+                        RsaSignature::<B, RsaPkcs1v15, Sha256>::sign(&privkey, MESSAGE).unwrap();
+                    assert!(RsaSignature::<B, RsaPkcs1v15, Sha256>::from_bytes(sig.bytes())
+                        .is_valid(&pubkey, MESSAGE));
+                }
                 let sig = RsaSignature::<B, RsaPss, Sha256>::sign(&privkey, MESSAGE).unwrap();
                 assert!(RsaSignature::<B, RsaPss, Sha256>::from_bytes(sig.bytes())
                     .is_valid(&pubkey, MESSAGE));
@@ -745,6 +793,12 @@
         fn test<B: RsaKeyBits>() {
             use public::testutil::test_signature_smoke;
             let key = generate_rsa_key::<B>();
+            #[cfg(feature = "rsa-pkcs1v15")]
+            test_signature_smoke(
+                &key,
+                RsaSignature::<_, RsaPkcs1v15, Sha256>::from_bytes,
+                RsaSignature::bytes,
+            );
             test_signature_smoke(
                 &key,
                 RsaSignature::<_, RsaPss, Sha256>::from_bytes,
@@ -766,6 +820,11 @@
             assert!(!sig.is_valid_format());
             assert!(!sig.is_valid(&generate_rsa_key::<B2048>().public(), &[],));
         }
+        #[cfg(feature = "rsa-pkcs1v15")]
+        {
+            test_is_invalid::<RsaPkcs1v15>(&RsaSignature::from_bytes(&[0; MAX_SIGNATURE_LEN + 1]));
+            test_is_invalid::<RsaPkcs1v15>(&RsaSignature::from_bytes(&[]));
+        }
         test_is_invalid::<RsaPss>(&RsaSignature::from_bytes(&[0; MAX_SIGNATURE_LEN + 1]));
         test_is_invalid::<RsaPss>(&RsaSignature::from_bytes(&[]));
     }
diff --git a/test.sh b/test.sh
index 3058f7b..c8831f6 100755
--- a/test.sh
+++ b/test.sh
@@ -8,7 +8,7 @@
 
 set -eu
 
-FEATURES="insecure kdf rand-bytes experimental-sha512-ec"
+FEATURES="insecure kdf rand-bytes rsa-pkcs1v15 experimental-sha512-ec"
 
 # Test with each feature individually
 for features in $FEATURES run-symbol-conflict-test; do