Looks like broken block signing is now a known issue with 4.2 GA:
BlockSignature content validation does not work with distributed search.
BlockSignature content validation does not work in 4.2 (GA), even without distributed search, and will falsely claim the data has been tampered with. (SPL-38082)
http://www.splunk.com/base/Documentation/4.2/ReleaseNotes/KnownIssues (under unsorted)
... View more