signed metadata verification