phase1: enforce proper umask during signing