X_STORAGE_URL_UNVERIFIABLE

nothing can check the signature — no verifier was supplied

acceptSignedUpload was called with no secret: and the disk's driver implements no verifySigned. Its own code deliberately, not X_STORAGE_URL_INVALID: "no verifier" and "this signature is forged" need opposite edits, and reporting the first as the second sends an operator hunting an attacker who is not there

implement verifySigned on the driver, or pass secret: explicitly — a local disk already verifies its own