the sources targeting should not happen if check_signature is True