> what value would such a test add

To verify that logic we've added in this PR works as expected? If it's currently exercised in one of the live or expect tests, obviously that's enough. Or if we feel that scenario is simply not achievable (i.e. there's no feasible way for a user to even _have_ a request double-signed), is the code even needed?

Right now, as far as I understand (and please correct me if I'm wrong!) we're adding a safeguard for which we can't find a trigger, and are not verifying whether it works.

Of course, I see your point about similar code not having tests, and would not want to hold up the PR for this - am just curious.