pkg signing