make signing mandatory only on upload