update sign to 2.5.0

this fixed a bug where we were ignoring the hash algorithm identifier in the signature, potentially validating malformed sigs, and also adds ripemd160 and md5 based sigs.