make sure key used for signing _can_ sign