sign assertion, not response