Some jars distributed in RPM are not signed. For instance:

[root@hp-xw9400-02 jboss-dist]# jar tf /var/lib/jbossas/server/all/deploy/admin-console.war/plugins/rhq-platform-plugin-3.0.0.B06.jar | grep RSA
[root@hp-xw9400-02 jboss-dist]#

Their ZIP counterparts are indeed signed:
[root@hp-xw9400-02 jboss-dist]# jar tf /root/workspace/jboss-eap-5.1/jboss-as/server/all/deploy/admin-console.war/plugins/rhq-platform-plugin-3.0.0.B06.jar | grep RSA
META-INF/JBOSSCOD.RSA
[root@hp-xw9400-02 jboss-dist]#

Please, see the dist-diff report, section "Removals" for all entries reporting a missing "JBOSSCOD.RSA".