Begin with structure
data should not be url safe encoded in PEM
Fix verification of SignResponse