verifyRsaPkcs1Signature

Verifies an RSA PKCS#1 v1.5 signature.

The full expected encoded message (EM) is reconstructed from the digest and its DigestInfo prefix and compared in constant time (RFC 8017, section 8.2.2). Comparing only the trailing hash bytes would accept classic low-exponent forgeries in which the attacker arranges the digest inside an otherwise arbitrary EM.