It's already grouped by signature, no? https://github.com/mozilla/socorro/blob/master/socorro/external/postgresql/raw_sql/procs/update_exploitability.sql#L73

I can certainly change the secondary to `signature ASC`. That will at least "stabilize" the result.