In DSS verification, don't use private data before it's set!

How did this ever pass even minimal testing?!