add RSA PSS verification support
move PSS to top of docs
make mgf private
consume errors before asserting