Challenge 6 description and POC are inaccurate/misleading

[mtomassoli]

Challenge 6 (KYC) is not about signature malleability, which would consist in changing the signature without invalidating it. (Something is malleable if you can change its shape without breaking it.)
In this challenge, any invalid signature will do. There's no need to start from a valid signature and alter the last byte. In a minimal POC a user deploys an app and the attacker calls onboardWithSig using a 0 signature. That's it!