* Fix non-exhaustive match in Windows signing path
The PublicKey enum gained P521, BrainpoolP256, BrainpoolP384, BrainpoolP512, and Ed25519 variants, but the Windows-specific match statements in windows.rs were not updated, causing a compile error on Windows builds.
Add wildcard arms that return a clean error for unsupported key types.
* Windows store: a key type it can't sign with is Unsupported, not a crypto failure
---------
Co-authored-by: Brandon Thomas <echelon@gmail.com>