fix: invalid checksum after signature; manually check signature before publishing

fix: invalid checksum after signature; manually check signature before publishing #485