Someone gave him the signature to verify the hash.

He explains it during this stream here:

https://www.youtube.com/watch?v=gjE4dEX2z9E

Someone else suggested he could have bought the signature. It wouldn't surprise me.