Ah, pre-signing various variants. I don't like it much and it'd be nice to try to figure out if it can be solved differently but from first glance it looks like it's at least better than the current situation.