ServerRequestSigner

Signs a device-scoped server request with the local device authentication key. Every call uses the current time and a fresh nonce, so a request sent again must be signed again. Never sees or returns private key bytes.