I realised I'd put the wrong value for the SUPublicDSAKeyFile in one of my projects and assumed I'd broken updates, because Sparkle would be unable to figure out the signatures (FWIW, I actually used the same URL as the appcast xml as the value).
But (thankfully!) updates still worked.
So, if this a bug, here's the report. If this a feature, I'd love to have it confirmed :)
Thanks for Sparkle, love it!