An image has a known critical flaw. Why is signature verification alone insufficient?

1. The signature must always be deleted before scanning
2. Vulnerability scanners can replace source trust completely
3. All signed images are automatically harmless
4. Authenticity does not establish absence of vulnerabilities