Ah yes, you are right. Plain filters should be signed as well otherwise someone could generate any image for any filter.

Should we tackle this in this pr? How should we do this?