If a signature header exceeds 1024 bytes in length (easily accomplished with "z" tags), the MTA truncates them which prevents successful validation.
The MTA setting in question is MaxMimeHeaderLength which defaults to 1024. It's configurable, but the default can cause this limit to be hit.
The filter can't do anything about it, so this should be documented.
Logged In: YES
user_id=1048957
Originator: YES
KNOWNBUGS file updated for next release. Not clear we can do much other than document this.
Logged In: YES
user_id=1048957
Originator: YES
v2.4.0 released; KNOWNBUGS now contains that information.