Signs a SHA-256 digest with the key, returning an ASN.1 DER ECDSA signature. A holder key may ask the holder to authenticate here.