verifying pax downloads - .sign files?