add xml parser and verify signature