Sign the actual data, not a hash of the data - this makes it work properly against mod_auth_pubtkt.