Be a bit paranoid and ensure the admin has CONFIGURE_UPDATECENTER before turning off signature checks.