Only validate signature, do not require certificate in every response