But the original question was whether the signature check should happen after applying the patch instead of before, and the answer is clearly "No!". You can and

But the original question was whether the signature check should happen after applying the patch instead of before, and the answer is clearly "No!". You can and should clearly do both, but if you'd have to decide either-or, always verify first, as early as possible.