Fixes from golint and go vet.

[golint](https://github.com/golang/lint) and `go vet` pointed out a number of cleanups that could be made on the code base. This PR addresses those suggestions, cleans up the relevant comments, and changes the README signing section to describe the current behaviour.
`crypto/x509` works in this quirky way where it will support hashes if they have been imported in the package. Are we sure we are not dropping 256 and 512 signatures support this way?

There are three places where these imports have been removed.