There is currently no MUST create signature versions (crypto-refresh-02)

Derek Atkins and @nwalfield observed that in crypto-refresh-02, we say "MUST NOT" generate v3 signatures and "SHOULD" generate v4 signatures, but there is no "MUST" generate signature version.

This will presumably change when we incorporate distinct v5 signatures, but we need to make sure it doesn't get left this way.