I'm fine with either option, the signing API has access to the tenantAlias now, so I don't think that any method signatures should be adjusted.