I wonder if the update was signed with a cert chaining to a CA with a private key of "4".