In the create metadata instruction from metaplex-metadata-program there is a loop over the creators array. A creator can only be verified if the creator's address is the updateAuthority address and if it signed the transaction (source-code).
But in the above transaction the first verified creator did not sign the transaction? How is that possible? Does it have to do something with the fact that the first verified creator is a pda, as per the metaplex candy guard instruction?