catcrypt security fix: sign metadata.