signing: fix upx decompression

• embed signature so that upx still recognizes its own format (make, cmake)
• update signature validation process
• also sign the binary before compression