pgp signatures might actually work