bad PGP signatures