Why do you get BAD_AGGREGATE_SIGNATURE even when the signature matches the public key and message?

This question was asked at chia_network.public on Keybase.

When you use AGG_SIG_ME the coin’s id and some additional bytes are appended to the message. Those additional bytes (named AGG_SIG_ME_ADDITIONAL_DATA in the constants file) are the following on mainnet: ccd5bb71183532bff220ba46c268991a3ff07eb358e8255a65c30a2dce0e5fbb. So, the computed message is message + coin_id + extra_data.

Just like to add that from what I have found on the topic of the additional data field, it is both the challenge hash or block header of the genesis block on whichever network you’re on, so that means that the ADD_DATA field is also different for every new testnet, including the newest one now being testnet10.