signature checks: install unsigned extensions