The previous "fix" caused significant performance degradation without the signature ever having a chance to trigger. Moving it to policy seems the best compromise, the alternative being outright removing it.
