Not sure, but I think this was addressed in 10.13.1.
Fix: disallow pre-signed url access if the signing key is not initialized. #40962