Check expected sender not only for signature-protected CMP messages