verify_signed_buffer: use pipe_command