it's better to also sign the 'Host:' content - thx Clint