ad_sign can't generate a unique key by itself. You have to pass in the object_id or other unique data. It doesn't really stop a double click since the same signed data can be submitted twice with a double click and it will still be valid.