from poking around the BVT perbuild results (part of MO duties), it looks like autoupdate has some repeatable failure against M67:

https://stainless.corp.google.com/search?view=list&first_date=2018-03-06&last_date=2018-04-02&test=autoupdate_CatchBadSignatures&status=GOOD&status=FAIL&status=ERROR&exclude_cts=true&exclude_not_run=false&exclude_non_release=true&exclude_au=true&exclude_acts=true&exclude_retried=true&exclude_non_production=true

no changes to the test since 2016: https://cs.corp.google.com/chromeos_public/src/third_party/autotest/files/server/site_tests/autoupdate_CatchBadSignatures/autoupdate_CatchBadSignatures.py?sq=package:piper%7C%5Echromeos_public$&dr=CSs

sample logs:
https://pantheon.corp.google.com/storage/browser/chromeos-autotest-results/188202131-chromeos-test/chromeos4-row4-rack11-host3/debug/

looks like things are going wrong around here:
https://cs.corp.google.com/chromeos_public/src/third_party/autotest/files/server/site_tests/autoupdate_CatchBadSignatures/autoupdate_CatchBadSignatures.py?rcl=19fee8a62f9d3862fef773a47cc106b04cc38c5c&l=155