I think I managed to make this happen in some combination of turning off mandatory encryption along with twiddling flags in their metadata. Either way, the root cause was indeed signature validation failing. I'm going to go back at the metadata with a hammer now since I'm being invited to do this on Windows. Thanks for your eyes.