It appears that this issue is pretty common among people that have the eficheck kext installed (those who have later beta versions of Sierra). So it's likely either a bug or the list of checksums, if that's what they're using, isn't exhaustive - which points to a basic flaw of this particular approach.