Change internal signature checking API to return bool

Don't throw on invalid signature, return bool as a more sane API.