After comparing the licenses in the files, I am convinced that 4.3a was re-released twice (see the wiki). Once with the license v2.4, and once with license v2.5 (as the note in the version history indicates). This explains why the current .sig file does not match the .exe, the .exe being the first re-release and the .sig matching the second re-release (the first release was embedded in a zip, using the old installer). That's why I'm renaming the .sig file to avoid confusion (it also failed the md5 test).