refer to correct signing key and update metadata location