Signature verification now works. Problem was that I was trying to verify the base64-encoded signature...