moved signing from user to security