Don't try and verify signatures if key is NULL (CVE-2013-0166)