Fixes from golint and go vet.

[golint](https://github.com/golang/lint) and `go vet` pointed out a number of cleanups that could be made on the code base. This PR addresses those suggestions, cleans up the relevant comments, and changes the README signing section to describe the current behaviour.
It will probably work, I still think they should be imported every time `crypto/x509` is imported, since otherwise it's just relying on another file importing them, and if that file is removed or anything this file is affected.

Also I'm afraid that the tests can be fooled if `crypto/sha256/512` is imported in a `_test` file.

Honestly, I find this imports side effects just silly, but that's how the stdlib is done :(