Or more generally, signatures would not work correctly for any case where the first TCP packet seen contained payload data, regardless of its TCP flags.
