although the previous handling assumed any unsigned/invalid signature message was a Create, lets make it more explicit