We treat a missing signature as suspicious. Should we?

As request-signing standards land for automated traffic, a question is going to come up fast: what do you do with everything that is not signed? The tempting answer is to treat unsigned as untrusted, ...