config: introduce separate CONFIG_SIGNATURE_CHECK option