`signTransaction` in builder.dart blindly wraps a provided `signatureHex`; validate it against `publicKey` + `transactionHash` before accepting.