[FIX] check for SigningPubKey, derive if not present