This has been fixed in 9.4.0-SNAPSHOT as of this commit https://github.com/itext/itext-java/commit/979cdc6f5a34b48be6fabefe90953f50142c59c7

To get started with snapshots follow this guide: https://kb.itextpdf.com/itext/installing-itext-for-java#InstallingiTextforJava-InstallingSNAPSHOTbuilds

It was indeed the way we compared the streams in the signatures to detect whether or not they have been altered since signing. We
decoded the stream and we don't support /JBIG2DECODE so it is an issue.
But to verify the changes we don't require to decode it as we can just compare the byte[] raw values.

Thank you for raising this question!