an unsigned query is seen. This should actually do the verification, but it's not currently possible. [RT #1391]