The signature was valid. The signer wasn't.
GET /api/lookup?hash=...
GET /api/distros
GET /api/distro/{slug}
POST /api/report