allow assertions to be signed before encryption