Bv2.1 8.7: CPLs with encrypted content must be signed.