Signing is accomplished in include/items:item_store for public items (after suitable input filtering has been run - as this can change the content which could make it impossible to verify). We sign private ones here before they get obscured, because this changes the body. It's a bit contorted to do it in different places but I haven't had time to re-arrange the code and fix this and want to obscure private stuff as quickly as possible so the contents won''t show in any normal log messages.