looks like some of the problems that signed streams have compared to content addressed streams are dealt with in the update framework.