This is a sort of follow up to LTI POST Request with Query String Parameters, as I'm having a similar issue.
When importing LTI links with metadata, Canvas appends said metadata as query parameters. As a result, our LTI signature check fails, similarly to the above referenced link.
Is this how Canvas handles metadata? If so, can anything be done to change it? This doesn't seem right to me.