final touches--actually do the signing, and verify with just a public key