The update works fine if updated via iTunes. Only OTA updates are broken. Maybe they didn't test the OTA update process? It sounds absurd but it's the only viable option in my mind.
It's surprising to me that those would even differ in the first place. You'd think that you'd have a single deliverable which is delivered and signed, and the installer does the same thing regardless of where it gets the package. What makes OTA different from iTunes?