Not sure I like the previous checkin. The whole point of server sig is to validate the server. This could leave apps open to fake servers. Reverting it for now