Checking the signature seems like it would be good practice. But that doesn’t mean that they do.