I stand corrected. If it’s truly only the signatures and zero other identifying info, then yes you’re as secure as the underlying algorithm. I think they implied there are multiple device-originated signatures for different parts of the data, this may open some possibilities for cryptanalysis