What do you think about rewording this (here and elsewhere) to "failed to submit"? Since this service _does_ fail to start, we expect it to.

If you object strenuously, can you add a one-line comment mentioning "fleetctl will succeed, but the service will be rejected by the engine due to lack of signature" or similar?