* enforce non-backend plugin signing * fix tests * add tests * add signatures * apply PR feedback * update upgrading docs