sign_data() and verify_data() common.api should be used whenever
possible.  Also, correctly format tracebacks in failures to import key
data.