Re: verifying signature for a package