When image scans fail, the image's signatures are not fetched. This is a problem with images that are known to fail scans, due to e.g. unsupported OS: those images can still be signed and ACS should both fetch and verify the signatures.

See this slack thread for details.