actually verify with the expected public key instead of using the system's list of keys