[backend] don't retry signing if the cpio.rsasign is bad