per-route sig keys can be base64