Add the Sign-At-Most-Once restriction the enterprise.platformKeys API.

chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Must be packed to ../enterprise_platform_keys.crx using the private key
 // ../enterprise_platform_keys.pem .
 
 var assertEq = chrome.test.assertEq;
 var assertTrue = chrome.test.assertTrue;
 var assertThrows = chrome.test.assertThrows;
@@ skipping 309 matching lines @@
                   assertEq(algorithm.modulusLength,
                            webCryptoPublicKey.algorithm.modulusLength);
                   return window.crypto.subtle.verify(
                       algorithm, webCryptoPublicKey, cachedSignature, data);
                 }),
                 function(error) {
             assertTrue(false, "Import failed: " + error);
           })
           .then(callbackPass(function(success) {
                   assertEq(true, success, "Signature invalid.");
+                  // Try to sign data with the same key a second time, which
+                  // must fail.
+                  return userToken.subtleCrypto.sign(
+                      {}, cachedKeyPair.privateKey, data);
                 }),
                 function(error) {
             assertTrue(false, "Verification failed: " + error);
-          });
+          })
+          .then(function(signature) {
+                  assertTrue(false, "Second sign call was expected to fail.");
+                }, callbackPass(function(error) {
+                  assertTrue(error instanceof Error);
+                  assertEq(
+                      'The operation failed for an operation-specific reason',
+                      error.message);
+          }));
     },
 
     // Imports and removes certificates for privateKeyPkcs8, which was imported
     // by on C++'s side.
     // Note: After this test, privateKeyPkcs8 is not stored anymore!
     function importAndRemoveCerts() {
       runAsyncSequence([
         chrome.enterprise.platformKeys.importCertificate.bind(
             null, userToken.id, cert1a.buffer),
         assertCertsStored.bind(null, userToken, [cert1a]),
@@ skipping 41 matching lines @@
           callbackFail('Certificate is not a valid X.509 certificate.'));
     },
     function getCertsInvalidToken() {
       chrome.enterprise.platformKeys.getCertificates(
           'invalid token id', callbackFail('The token is not valid.'));
     }
   ]);
 }
 
 beforeTests(runTests);