besides anyone can use the public key to verify the signature