Here, it might be worth a similar cleanup and then also protecting more locally against bad input that might crash things.

```
try public_key:verify(Plain, sha, base64:decode(AuthSig), PublicKey) of
    true ->
        {name, UserId};
    _ ->
        {no_authn, bad_sig}
catch
    _:_ ->
     % could log or attach a different reason tag if we cared
    {no_authn, bad_sig}
end
```