SignatureStores is a TP feature which should be hidden by default. But when enabling DynamicResourceAllocation fs in CustomNoUpgrade, SignatureStores api could be available unexpectedly while the featuregate status shows it's disabled actually.

//before adding CustomNoUpgrade featuregate, SignatureStores is disabled and api is not available as expect.
# ./oc get featuregate cluster -ojson|jq .spec
{}

# ./oc get featuregate cluster -ojson|jq .status.featureGates[].disabled|grep -E "SignatureStores|DynamicResourceAllocation"
    "name": "DynamicResourceAllocation"
    "name": "SignatureStores"

# ./oc patch clusterversion version --type merge -p '{"spec": {"signatureStores": []}}'
Warning: unknown field "spec.signatureStores"
clusterversion.config.openshift.io/version patched (no change)

//after adding DynamicResourceAllocation in CustomNoUpgrade, SignatureStores is still disabled, but api is available unexpectedly.
# ./oc patch featuregates/cluster --type=merge --patch='{"spec":{"featureSet":"CustomNoUpgrade","customNoUpgrade":{"enabled":["DynamicResourceAllocation"]}}}'
featuregate.config.openshift.io/cluster patched

# ./oc get featuregate cluster -ojson|jq .spec
{
  "customNoUpgrade": {
    "enabled": [
      "DynamicResourceAllocation"
    ]
  },
  "featureSet": "CustomNoUpgrade"
}

# ./oc get featuregate cluster -ojson|jq .status.featureGates[].disabled|grep -E "SignatureStores|DynamicResourceAllocation"
    "name": "SignatureStores"

# ./oc get featuregate cluster -ojson|jq .status.featureGates[].enabled|grep -E "SignatureStores|DynamicResourceAllocation"
    "name": "DynamicResourceAllocation"

# ./oc patch clusterversion version --type merge -p '{"spec": {"signatureStores": []}}'
clusterversion.config.openshift.io/version patched

# ./oc get clusterversion version -ojson|jq .spec
{
  "channel": "stable-4.14",
  "clusterID": "0f862ace-7b3f-4302-8b30-f7c35915aa46",
  "signatureStores": []
}

    4.15.0-0.nightly-2023-12-08-202155

    always

    1. add CustomNoUpgrade featureSet without SignatureStores
    2. 
    3.
    

    SignatureStores api is available unexpectedly

    SignatureStores api should be hidden