use sha256 for signatures

cherry picked b7297a70ffe8afc4c53c51d705dba8ec40f21aa4