Fix #15: use sha1 hashes for double signing