encrypt response and check signature before decrypt request