// key for signature is hash + version + size so we have some
// control over auto-update process and prevent people from injecting
// potentially huge bogus updates
signature.update( encode( hash, version, size ));
return( signature.sign());
}
protected static boolean