ASN.1 signatures aren't really much better - they go through a similar normalization step (BER vs. DER) and the payload contains the signature so you have to pu

ASN.1 signatures aren't really much better - they go through a similar normalization step (BER vs. DER) and the payload contains the signature so you have to pull it out before validating the signature. It's just that it's been around long enough that (we hope) the kinks in the system have been discovered and worked out.