vanilla verify-sig
