Entity.SignIdentity used the wrong signature function and produced invalid
certification signatures. Fixed.
VerifyUserIdSignature was used for checking the self-signature on an identity,
but didn't support anything but a self-signature. This change alters the
low-level API so that checking cross-signatures is possible.
Fixesgolang/go#7371.
LGTM=bradfitz
R=bradfitz
CC=golang-codereviews
https://golang.org/cl/96240043