signatures not required: an untrusted-cert-signed package installs as unsigned
