Loosen signature injection behavior in non-secure mode

If secure mode is possible, let signature injection depend on secure
mode setting. If not, depend only on the config value. Even some TWRP
recoveries seem to still have issues with injecting the verification
keys. As nobody seems to be reporting any useful info on why this is,
we're (optionally) disabling signature checking when secure mode is
disabled, until we can figure out what the problem is.