perhaps the upstream normally publishes signatures, but sometimes forgets - that would be a sensible reason for the maintainer to retain the disabled code - if most often, there will be no signature, i would delete the disabled code so, the obvious follow-up question being "does/will the upstream publish signatures?"