finish sign/verify for tar files; minor improvements