Add methods to sign a SHA256 digest directly and improve tests

These new methods will become useful later, but more importantly this corrects the documentation that claimed `signData` did not use a digest. The tests are also improved, including verifying against a precomputed known-good signature.