Verify returns nil if signature is valid
(signingString, signature []byte, key Key)
source not stored for this graph (policy: none)
no outgoing calls