moved things into verify signature