This way we only check the correctness of *new* UDF:s, and not old one
that might be correct, but have signatures made with an expired key
which otherwise report useless errors.