Client should check that the username matches the signaturePublicKey. maybe public key/name registry makes sense here