If we do NOT hash UPDATE_JSON and use the signature taken over update.json itself the tests pass