It would be nice to have an option (perhaps part of bitbake -S printdiff, or an additional option?) which tells you what the delta between the current locked signatures and the unlocked value would be.
Mark, didn't you work on locked sigs a while ago? Do you want to work on this ER ?