signature: add FIPS error state handling