Finally understood a bit of cryptography. Migrated install certs to use crypto properly; now keep the expected value, along with the signed value.