check for public key before verifying signature