auth: provide private pointer and do not return original PAC signatures