Add check for matching group in CertificateSelection

[tatianab]

Currently, the CertificateSelection function calls the schemeValidForKey function, which checks if the signature type (RSA_PKCS1, RSA_PSS, or ECDSA) is correct for the given key, but does not check if the underlying group is correct for the signature algorithm in the ECDSA case. This causes the function to sometimes output a signature algorithm incompatible with the chosen certificate.

I propose to add the following check inside schemeValidForKey:

func schemeValidForKey(alg SignatureScheme, key crypto.Signer) bool {
        ...
    case *ecdsa.PrivateKey:
        // proposed check
        if curveFromNamedGroup(curveMap[alg]) != key.Public().(*ecdsa.PublicKey).Curve {
            return false
        }
       ...

If you agree, I will submit a PR with this change.

@chris-wood