verifying signature for a package