signature verification works now