signature is verified with signed_content_bin