sign only packets that don't have a signature already
when a packet is deleted, delete the trust paths that go through it