Support providing a challenge explicitly.
Use OpenSSL for random.
Fix description of SignResponse in comment.