Instead of just passing a package name to performBackup, pass the whole PackageInfo struct, explicitly including the list of signatures for the package. No need to make each transport look this up individually when it's a necessary part of the backup payload for each app.