Many popular apps fail to verify using bundletool 1.18.3

[greyson-signal]

Describe the bug
If you use bundletool 1.18.3 with the following command:

bundletool check-transparency  \
  --mode=connected_device \
  --package-name="<package>"

With any of these popular apps:

• Signal: org.thoughtcrime.securesms
• WhatsApp: com.whatsapp
• Messenger: com.facebook.orca

You'll get this error:

Verification failed: APK signature invalid for base.apk 

Bundletool version(s) affected
Version: 1.18.3

Stacktrace
None

To Reproduce

bundletool check-transparency  \
  --mode=connected_device \
  --package-name="<package>"

Expected behavior
I would expect it to verify

Known workaround
If you apply this PR my colleague made to update apksig, everything works.

Environment:
OS: Ubuntu 24.03, but I suspect this doesn't matter

Additional context
Add any other context about the problem here.