code: func ecVerify(ctx pkcs11helpers.PKCtx, session pkcs11.SessionHandle, object pkcs11.ObjectHandle, pub *ecdsa.PublicKey) error {
  	nonce, err := getRandomBytes(ctx, session)
  	if err != nil {
  		return fmt.Errorf("failed to construct nonce: %s", err)
  	}
  	log.Printf("\tConstructed nonce: %d (%X)\n", big.NewInt(0).SetBytes(nonce), nonce)
  	hashFunc := curveToHash[pub.Curve.Params()].New()
  	hashFunc.Write(nonce)
  	digest := hashFunc.Sum(nil)
  	log.Printf("\tMessage %s hash: %X\n", hashToString[curveToHash[pub.Curve.Params()]], digest)
  	signature, err := pkcs11helpers.Sign(ctx, session, object, pkcs11helpers.ECDSAKey, digest, curveToHash[pub.Curve.Params()])
  	if err != nil {
  		return err
  	}
  	log.Printf("\tMessage signature: %X\n", signature)
  	r := big.NewInt(0).SetBytes(signature[:len(signature)/2])
  	s := big.NewInt(0).SetBytes(signature[len(signature)/2:])
  	if !ecdsa.Verify(pub, digest[:], r, s) {
  		return errors.New("failed to verify ECDSA signature over test data")
  	}
  	log.Println("\tSignature verified")
  	return nil
  }
docs: // ecVerify verifies that the extracted public key corresponds with the generated
  // private key on the device, specified by the provided object handle, by signing
  // a nonce generated on the device and verifying the returned signature using the
  // public key.