JWS: fix insecure crypto

Some signing algorithms need random input to be secure.  For
example, ECDSA requires a random number for each signature, or the
scheme is utterly insecure.  RSA needs some entropy for a blinder to
defeat timing attacks.

Update the 'sign' function to take a CPRG and return '(sig,g')' and
chase the API change around.