Also have we *always* used strict encoding? We can't start throwing InvalidSignature on data that we previously decoded successfully.  Similarly there's no security implications of allowing the non-strict decoding, the data is signed anyway.