Use proper EPKG_OK/FATAL for return
We are signing with SHA256 RSA, not SHA1