remote comment headers, fix credential var names, fix sig verify fn