validate github signatures