Isn't the master key vulnerability related to the SIM card attack, and not to the app signature vulnerability? Maybe I'm reading the article wrong, but this article seems to be confusing two non-related vulnerabilities.