private void verifySignature(VerificationResponse response) throws YubicoValidationFailure, YubicoVerificationException {
        StringBuilder keyValueStr = new StringBuilder();
        for (Entry<String, String> entry : response.getKeyValueMap().entrySet()) {
            if ("h".equals(entry.getKey())) {
                continue;
            }
            if (keyValueStr.length() > 0) {
                keyValueStr.append("&");
            }
            keyValueStr
                    .append(entry.getKey())
                    .append("=")
                    .append(entry.getValue());
        }
        try {
            String signature = Signature.calculate(keyValueStr.toString(), key).trim();
            if (!response.getH().equals(signature) &&
                    !response.getStatus().equals(BAD_SIGNATURE)) {
                // don't throw a ValidationFailure if the server said bad signature, in that
                // case we probably have the wrong key/id and want to check it.
                throw new YubicoValidationFailure("Signatures do not match");
            }
        } catch (YubicoSignatureException e) {
            throw new YubicoVerificationException("Failed to calculate the response signature.", e);
        }
    }