If you look at CMS, given that most people include authenticated attribute, you never actually sign the data. You sign the digest of the data and the authenticated attributes. Validating the digest of a resource is not enough. If the resource changes, the signature should break. As my previous mail has stated.
Location is a hint for where the document is.
The fact that you update the document at a URL location will not allow you to repudiate the fact that you signed the document. I can cache the document locally and take that copy into court when attempting to enforce your signature. How is core behavior, independent of application-specific behavior, going to validate a given signature if it does not know how to dereference a location. It cannot depend on application specific caching mechanisms.