Okay, if we're talking about the larger change for v4 I'm not too concerned for 3x of always doing the hash (and perhaps never doing Authenticode, though I still argue the revocation ability for bundles already "out there" is big enough to consider - but that's a conversation for another time).