Not certain what you mean about the IP address, but for signing it, they would need to bundle a key and that could be extracted.

It is a genuinely tricky challenge from their perspective.