update: use gcrypt enums, they are mapped to the spec already
update: use the digest algo specified in the signature

We already check that it is SHA1