voa: documentation update, param is in,out not just out
voa: don't accept unsigned requests

doesn't make much sense since they're not worth much when
keys are transmitted in plain text.