use sha256 for signatures