I think this may be too verbose. Can we log only if signature validation fails (with prio INFO)?