If the key to sign the clusterTime was not available, VectorClock::SignedComponentFormat::out will not write it to the BSON builder and will return false. Then VectorClock::gossipOut may have built $configTime and $topologyTime, but not $clusterTime, and thus return false. Finally, VectorClockMetadataHook::writeRequestMetadata will write only $configTime and $topologyTime to the request. The receiving node will then possibly advance it's VectorClock::configTime but not the clusterTime. So configTime could become ahead of clusterTime.