Add the Sign-At-Most-Once restriction the enterprise.platformKeys API.

chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js

Index: chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js
diff --git a/chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js b/chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js
index 557ae680c4cf2d22d441f75f4426449e1c7d161d..c05e002a480ffc34c656817ec277cdbeb29e735e 100644
--- a/chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js
+++ b/chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js
@@ -327,10 +327,22 @@ function runTests(userToken) {
           })
           .then(callbackPass(function(success) {
                   assertEq(true, success, "Signature invalid.");
+                  // Try to sign data with the same key a second time, which
+                  // must fail.
+                  return userToken.subtleCrypto.sign(
+                      {}, cachedKeyPair.privateKey, data);
                 }),
                 function(error) {
             assertTrue(false, "Verification failed: " + error);
-          });
+          })
+          .then(function(signature) {
+                  assertTrue(false, "Second sign call was expected to fail.");
+                }, callbackPass(function(error) {
+                  assertTrue(error instanceof Error);
+                  assertEq(
+                      'The operation failed for an operation-specific reason',
+                      error.message);
+          }));
     },
 
     // Imports and removes certificates for privateKeyPkcs8, which was imported