A story of three kernel vulnerabilities

There's nothing about signing stuff that requires ASN.1 or X.509. Also, it's entirely possible that userspace uses ASN.1/X.509 to get at the keys to sign with, but something else to carry the signature itself.

If the kernel must parse ASN.1/X.509 to parse the signature for authentication...yikes, but that's not a requirement. (And even if they are, I hope it's a really limited implementation.)