We were originally trying to signing full packages and that involved opening them, changing data and then trying to close them again; this was rather messy for the Linux and Windows cases