i thought the signature was supposed to be a hash of both secrets