fix decrypt_sig to accept binary cert