testing only: does not verify signatures