verify_signature() now processes hash not data