Further update. I notice that certutil is reporting “No AT_SIGNATURE key for reader”, even though the key pair has all usages (sign/verify, encrypt/decrypt, and wrap/unwrap). It appears the minidriver is reporting only AT_KEYEXCHANGE keys.
SignTool presumably wants an AT_SIGNATURE key.
I also see that when SignTool fails, I get an event 610 in the System event log, complaining ioctl 0x313520 (IOCTL_GET_FEATURE_REQUEST) failed. There are some discussions of similar issues in the OpenSC forums. It looks like a driver issue of some sort.