validate signature fields against request, pull public verify key from DB, start using UTC everywhere