externalized app signing