Comment by nailer

I've heard the same for Windows code signing certs - that's it possible to modify the payload and have the signature still apply.