> Additionally, the XML returned by the update server is now singed (XMLDSig)

XMLDSig is notoriously difficult to implement correctly and securely, I hope this doesn't backfire.