I've been experimenting with MBEDTLS on an ARM-M4 (but this question is not platform-specific) and am confused/surprised regarding the computational complexity (execution time) of `mbedtls_rsa_pkcs1_sign()` versus `mbedtls_rsa_pkcs1_verify()`. Apparently the _sign is much more computationally complex than the _verify. I don't understand this and would expect the opposite to be true.
 
Observations:

 - `mbedtls_rsa_pkcs1_decrypt()` or  `mbedtls_rsa_pkcs1_sign()`    < 3 secs
 - `mbedtls_rsa_pkcs1_encrypt()` or  `mbedtls_rsa_pkcs1_verify()`  < 100 millisecs
(this is for RSA-2048 / SHA-256)

I would have assumed that the verify should be similar in complexity to the decrypt (because it requires decryption of the signature hash) and that the sign would be similar in complexity to encrypt (because it requires encryption of the hash). I understand that for the signature operations the Private and Public key use is reversed, but I'm not sure how/why that affects things.