Clarify hashing for the sign/verify APIs

We need to clarify when the user needs to hash data for RSA signing, and when tomcrypt will do it for them.

Perhaps even going to far as to re-evaluating the standard signing API that tomcrypt shares with nearly every other lib.

Could tomcrypt do the hashing? Does it really need to make sure it was the same hash by comparing OIDs? Etc..
