'Get model instances that were signed by devices in the zone,
or signed by a trusted authority that said they were for the zone,
or not signed at all and we\'re looking for models in our own zone.'

def by_zone(self, zone):

    condition = (Q(signed_by__devicezone__zone=zone, signed_by__devicezone__revoked=False) | Q(signed_by__devicemetadata__is_trusted=True, zone_fallback=zone))
    if (zone == _get_own_device().get_zone()):
        condition = (condition | Q(signed_by=None))
    return self.filter(condition)
