Advanced AI Prompt for Google Cloud Storage Signed URL Service Account Role

Act as a GCP Security Architect. Define the absolute minimal IAM configurations required for a service account [SERVICE_ACCOUNT_NAME] to programmatically generate GCS Signed URLs for the bucket [BUCKET_NAME]. Create a custom IAM role YAML definition that includes only `storage.objects.get` and `storage.objects.list`. Provide the exact `gcloud` command to bind this custom role to the service account at the bucket level. Furthermore, explain technically why the `iam.serviceAccounts.signBlob` permission is a prerequisite on the service account resource itself for the cryptographic signing process to succeed without requiring downloaded JSON keys.