sign works; todo update nonce