That IMO does not, in any respect, excuse the signature design. This JSON+blobs design is totally new other than needing to support a handful of preexisting fi

That IMO does not, in any respect, excuse the signature design. This JSON+blobs design is totally new other than needing to support a handful of preexisting fields. And it’s very much the case that a lot of the record is trusted in the sense that loading malicious data could compromise the integrity or availability of the machine. So structure it like that! Have a whole file that is signed or otherwise integrity-checked in its entirely. Have another file with fields that are per-(user,machine) and integrity-check that. “Integrity-check” means that you validate the binary contents of the file before you even attempt to parse it, and then you parse the literal bytes that you checked. It’s not the nineties anymore, and architects should know better.