All this means is that any server can choose to present any bytes, even with TLS, as a response to any request. This isn't a novel observation.
If a signed exchange includes a URL, that URL must be signed for the browser to respect the field.
If a signed exchange includes a URL, that URL must be signed for the browser to respect the field.