Here is the response I got from L3 Support.
first of all we need to outline that the message “class NotASignedMessage” for few opsites doesn’t prevent the correct working of the BigFix environment.
The standard way to fix this error message is to run the iem command to propagate the operators again.
However, in case the DSA is not configured in the customer environment, starting from 9.5.7 we have an hidden feature that, if enabled, will automatically fix this kind of error message.
The feature exposes the following client setting that, when enabled on the BigFix Server, triggers the unsubscription of the missing opsites:
_BESGather_UnsubscribeSiteOnDBError default 0
1: automatically create the unsubscription action for sites not in DB
0: do nothing
I am going to try the setting on the Bigfix Server.