The signature is calculated over locked and exclude fields as well as a hash
of $fields. The $fields data will not become part of the final form signature
string. The $fields hash is not signed itself as the hash will become part
of the form signature string which is already signed.