[cellarius]

Does this really help? As far as I know, this only rebuilds existing signatures, but does not check for permission changes. But the OP should definietely give it a try.

Can it be fixed? Well, its not exactly broken - it just does not offer the feature you require. Probably one could try to run a cron checking all existing signtures against the current permission set, or try a plugin checking all signatures concerned when usergroup changes occur. But both would not be trivial, given you would have to then block the signatures in some way and notify the user. Simply deleting would probably lead to some very unhappy users (and rightly so).