Oh, I remember being hit by this. Agree that it's not well documented; I think it's there to prevent "signing services" from spring up (not that it does a great job…)