if its externally mandated, it should probably stay as is. is there a report in upstream sbsigntools tracker?