we're checking the signature here by decrypting using the public key that verifies that this message was created by someone who knows the private key so we verify the signature, and you might think that would be enough.