mktag: call "check_sha1_signature" with the replacement sha1