Makefile.PL asked you whether or not Digest::SHA1 should be installed
automatically. This really just means automatic installation via
Module::AutoInstall. It's still a required dependency[1] and was
reported as such at the end of the Makefile.PL output. You just chose to
install it manually.
1. actually, it's not anymore. these days any of Digest::SHA1,
Digest::SHA or Digest::SHA::PurePerl are required.
Also, future versions of Module::Signature will stop asking you whether
or not dependencies should be installed automatically, to avoid confusion.