better way to return a random sha1
more refactoring of signing, getting cleaner