App will only install using AIR 1.5.3

Question

I recently packaged and signed an application using the AIR 1.5.3 SDK. The app will now only install if the user has AIR 1.5.3, and fails with 1.5.2, 1.5.1, etc. The application namespace is AIR 1.5, not 1.5.3.
This is an application update, though it also fails on a <1.5.3 system without a previous install. I logged the error during app install:
failed while unpackaging: [ErrorEvent type="error" bubbles=false cancelable=false eventPhase=2 text="invalid package signature" errorID=5022]
The certificate used to sign this app has recently expired. Is that the problem?
This is really frustrating. I intentionally signed the app update BEFORE the cert expired to avoid all this crazy s#%^# about migration signatures, botched publisher ids, requiring users to have AIR 1.5.3 etc (or at least kick it down the road 6 months; AIR 1.5.3 had just come out). Now it looks like all users who try to install this app will need AIR 1.5.3 anyway.
I suppose that since users need (certain) admin rights to install the app anyway, updating to 1.5.3 won't be a barrier. But it's still an added aggrevation and yet another thing we need to QA. The client won't be happy.
So is this a bug or a feature? If I signed using the AIR 1.5.2 SDK would the thing still work?

Answer 1

I understand that I should (need to) use AIR 1.5.3 to update an app _after_ a cert expires.
However this particular issue should be noted in the documentation, at least after some testing and clarification. Here's the best succinct description of this problem I can think of:
If you sign an application update with a valid certificate using ADT 1.5.3 and:
-- your certificate subsequently expires and
-- it does not define the 1.5.3 namespace then
you will need to resign your application defining the namespace as AIR 1.5.3 and use the 1.5.3 certificatemigration procedure. Users of your application will be required to update to AIR 1.5.3.
I haven't yet tested the original application install on a non-1.5.3 system since the certificate expired. However I would _assume_ it still installs, since documentation states that an application signed with a valid certificate (and a timestamp) that subsequently expires will install any time in the future.
So it seems using ADT 1.5.3 for signing REQUIRES end users to use 1.5.3 because of this problem, since once the cert expires (almost guaranteed to occur during any 12 month period) users with <1.5.3 will see the installation error if the app namespace is not 1.5.3.  This is a fundamental problem since preparing/signing an app with a particular ADT version should not require that version for the end user.
I'll try to test the original signed app on a <1.5.3 system:
-- If it works that means this issue should be flagged in the AIR documentation somewhere.
-- If it fails, that means this post is wrong, and it also means that any AIR app whose cert expires will fail to install.
So I'll need to re-prepare my app update using the AIR 1.5.3 certificate migration procedure.