copy hash ctx inside sign/verify to avoid use after finalize