So you mean the signature algorithm was not fully part of the signature? Indeed that’s a recipe for disasters as the numerous TLS attacks have shown (logjam, freak, drown)