don't care too much.  It might be better to fold SignatureForCredentials into this file as a private static class