It would be nice to know the original release dates for those variants, but I think one possibility is that variant 235 has been released *after* 280 and it happen to have a sw-cert that is newer.
I don't know all the details about the swcerts, but I do remember that the system is running some cross-checks about the validity of the certificates (which have e.g. a field 'valid from'), so it's possible that operation that you were trying implied a 'downgrade' in swcert version, and because of that it was blocked.