Should the `sha` argument be coming from `?default_signing_algorithm`?