pup bundlers also tend to be signed. just checking for a valid signature would not be enough