log.error("The server did not sign a message we expected to be signed");
            return true;
        }

        final byte[] sig = new byte[SIGNATURE_LENGTH];
        System.arraycopy(data, offset + SIGNATURE_OFFSET, sig, 0, SIGNATURE_LENGTH);

        // Use fine-grained locking for verification
        this.signingLock.lock();
        try {
            if (this.closed) {

            for (int i = 0; i < SIGNATURE_LENGTH; i++) {
                data[SIGNATURE_OFFSET + i] = (byte) 0xFF;
            }

            digest.sign(data, 0, data.length, request, response);

            // Verify signature field contains actual signature (not all zeros)
            byte[] signature = Arrays.copyOfRange(data, SIGNATURE_OFFSET, SIGNATURE_OFFSET + SIGNATURE_LENGTH);
            boolean allZero = true;