paygens are failing with:
08:18:47: ERROR: <class 'chromite.lib.cros_build_lib.RunCommandError'>: return code: 1; command: cros_sdk -- check_update_payload /tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/delta.bin.signed --check --type full --disabled_tests move-same-src-dst-block --part_names kernel root --dst_part_paths /tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/new_kernel.dat /tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/new_root.dat --meta-sig /tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/delta.bin.signed.metadata-signature --metadata-size 49666
Error: metadata signature: signed hash (zEYYM8rG6iygwYiKGBBcOajDicdzNj5JT+Om8APegs4=) different from actual (yLSsfIACoVkHYhyXArf1yr0PAFZKItxhEcRlfp46eiU=).

cmd=['cros_sdk', '--', 'check_update_payload', '/tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/delta.bin.signed', '--check', '--type', 'full', '--disabled_tests', 'move-same-src-dst-block', '--part_names', 'kernel', 'root', '--dst_part_paths', '/tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/new_kernel.dat', '/tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/new_root.dat', '--meta-sig', '/tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/delta.bin.signed.metadata-signature', '--metadata-size', '49666']
Traceback (most recent call last):
  File "/b/swarming/w/ir/cache/cbuild/repository/chromite/lib/parallel.py", line 602, in TaskRunner
    task(*x, **task_kwargs)
  File "/b/swarming/w/ir/cache/cbuild/repository/chromite/lib/parallel.py", line 800, in <lambda>
    fn = lambda idx, task_args: out_queue.put((idx, task(*task_args)))
  File "/b/swarming/w/ir/cache/cbuild/repository/chromite/lib/paygen/paygen_build_lib.py", line 239, in _GenerateSinglePayload
    dry_run=dry_run)
  File "/b/swarming/w/ir/cache/cbuild/repository/chromite/lib/paygen/paygen_payload_lib.py", line 734, in CreateAndUploadPayload
    dry_run=dry_run).Run()
  File "/b/swarming/w/ir/cache/cbuild/repository/chromite/lib/paygen/paygen_payload_lib.py", line 609, in Run
    self._VerifyPayload()
  File "/b/swarming/w/ir/cache/cbuild/repository/chromite/lib/paygen/paygen_payload_lib.py", line 582, in _VerifyPayload
    self._RunGeneratorCmd(cmd)
  File "/b/swarming/w/ir/cache/cbuild/repository/chromite/lib/paygen/paygen_payload_lib.py", line 140, in _RunGeneratorCmd
    combine_stdout_stderr=True)
  File "/b/swarming/w/ir/cache/cbuild/repository/chromite/lib/cros_build_lib.py", line 647, in RunCommand
    raise RunCommandError(msg, cmd_result)
RunCommandError: return code: 1; command: cros_sdk -- check_update_payload /tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/delta.bin.signed --check --type full --disabled_tests move-same-src-dst-block --part_names kernel root --dst_part_paths /tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/new_kernel.dat /tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/new_root.dat --meta-sig /tmp/tmp.mONEBR7rE3/paygen_payload.DQffZW/delta.bin.signed.metadata-signature --metadata-size 49666
Error: metadata signature: signed hash (zEYYM8rG6iygwYiKGBBcOajDicdzNj5JT+Om8APegs4=) different from actual (yLSsfIACoVkHYhyXArf1yr0PAFZKItxhEcRlfp46eiU=).

probably checK_update_payload can't handle major version 2. I've tested this and it worked  in the past.

I'm going to revert https://chromium-review.googlesource.com/c/chromiumos/chromite/+/1234822

to fix and reland later.