This is mostly a reminder to myself to fix this. It looks like the displayed sig is the concatentation of the user's sig (text) and website url (as an HTML link). The problem is that the whole thing is HtmlEncoded instead of just the text sig part.
The mojoportal.com site doesn't seem to display sigs at all so I'm guessing Joe removed them in the 2.1 branch and this isn't an issue there.
--Dean