Same idea as above.  Except at this point, nothing has happened.  In the future, might want to deserialize all objects, loop through them to verify the signature, then return the (repackaged) object stream.