Here are some details and a resolution we found for error: 13875 while downloading the catalog in the SCCM console.
I fixed the error "13875" (which means Invalid certificate signature) when trying to subscribe to third-party updates in the ConfigMgr console.

If I tried the Patch My PC publishing tool, the logs would say "An error occurred while publishing an update to WSUS: Verification of file signature failed for file"
I downloaded the cab file manually from the site server and viewed the digital signatures of the cab, and noticed this:

Turns out the site server which had the WSUS installed was missing a whole bunch of Trusted Root certificates and Intermediate root certificates for Comodo/Digicert etc.
Once I added the certs, it could sync fine when adding the updates. I hope this helps if some of your other customers have the issue.
Thanks for the details above Nick!