Script: canonical pubkey and sig