fetcher: sign object fetches if configured