Add the Sign-At-Most-Once restriction the enterprise.platformKeys API.

chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js

Index: chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js
diff --git a/chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js b/chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js
index b095e9eecf2be211bf1c5ba8053b0952aa78312c..e4f8995832145c08fb40f37dad4ea431bc7cb9ce 100644
--- a/chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js
+++ b/chrome/test/data/extensions/api_test/enterprise_platform_keys/basic.js
@@ -337,10 +337,22 @@ function runTests(userToken) {
           })
           .then(callbackPass(function(success) {
                   assertEq(true, success, "Signature invalid.");
+                  // Try to sign data with the same key a second time, which
+                  // must fail.
+                  return userToken.subtleCrypto.sign(
+                      {}, cachedKeyPair.privateKey, data);
                 }),
                 function(error) {
             assertTrue(false, "Verification failed: " + error);
-          });
+          })
+          .then(function(signature) {
+                  assertTrue(false, "Second sign call was expected to fail.");
+                }, callbackPass(function(error) {
+                  assertTrue(error instanceof Error);
+                  assertEq(
+                      'The operation failed for an operation-specific reason',
+                      error.message);
+          }));
     },
 
     // Imports and removes certificates for privateKeyPkcs8, which was imported