Track when the pulled event signature fails

Part of #13700

synapse/federation/federation_base.py

@@ -80,7 +80,13 @@ async def _check_sigs_and_hash(
           InvalidEventSignatureError if the signature check failed. Nothing
              will be logged in this case.
         """
-        await _check_sigs_on_pdu(self.keyring, room_version, pdu)
+        try:
+            await _check_sigs_on_pdu(self.keyring, room_version, pdu)
+        except Exception as exc:
+            await self._store.record_event_failed_pull_attempt(
+                pdu.room_id, pdu.event_id, str(exc)
+            )
+            raise exc
 
         if not check_event_content_hash(pdu):
             # let's try to distinguish between failures because the event was
@@ -116,6 +122,9 @@ async def _check_sigs_and_hash(
                         "event_id": pdu.event_id,
                     }
                 )
+                await self._store.record_event_failed_pull_attempt(
+                    pdu.room_id, pdu.event_id, "Event content has been tampered with"
+                )
             return redacted_event
 
         spam_check = await self.spam_checker.check_event_for_spam(pdu)