use configured scheme, not stored scheme when checking signatures

protects against notebook author choosing bad hash scheme.