verify incoming sig first and fail earlier