update checkpoint.
check for valid pubkey in check_signature (before openssl would fail sig check but now secp256k1 just asserts).