When does SM come into play? It shouldn't be making a difference if we talk signed packages, or am I wrong?

True, SM doesn't make any difference here

I will look into why we don't see the SecurityException about the certificate miss match with 2.4.4.