add detached signatures; add AAD