Check your games with NX Game Info. If any of them fail signature checks they will not install without enabling installing of unsigned code in the Tinfoil settings.
However, that's not recommended unless you trust every NSP you install because it makes you vulnerable to malicious NSPs.
Games that are converted from XCI (NX Game Info tells you if they are) will always fail signature checks, and can not be verified good and not corrupted/malicious. I installed a converted XCI of Ni No Kuni that turned out to be corrupted, as there were some corrupted textures ingame, and I had random crashes. In the case where you can't find a CDN dump of a game and only converts are available, it's better to download an XCI and install it with Tinfoil, it will be auto converted and since it has the original XCI, signature checks will still pass during install so it will install fine.
CDN dumps (NX Game Info will tell you if they are in CDN format) should never fail signature checks, it's a sign that the NSP has been tampered with. Many scene release DLCs will fail signature checks though, because they are forged from data mined from the game, and not properly dumped from CDN. These should still be safe to install as long as you know they are the original scene releases.
That's why they won't install in Tinfoil.
However to run any installed games that are from XCI converts or "fake" DLCs, homebrew NSPs and such, you also need the correct sig patches. That's why they still won't run even when installed with Goldleaf. In my opinion Goldleaf should not allow you to install such titles without any warning but I digress.
Have a look at the launch entry in your bootloader\hekate_ipl.ini
Does it say payload=atmosphere\fusee-primary.bin or fss0=atmosphere\fusee-secondary.bin?
You need different sig patches depending on which method you are using.
https://github.com/Joonie86/hekate/releases
If you are using fusee-primary use Atmosphere_patches_.for.fusee.primary.only.7z and extract it to SD.
If you are using fusee-secondary use Kosmos_patches_12_08_2019.zip, extract it to SD
and add kip1patch=nosigchk on a new line in the launch entry, if it's not already there. Ignore that it says Kosmos, it has nothing to do with Kosmos. It's just the sig patches. I don't use Kosmos myself and I don't recommend it because it doesn't teach you what you're doing so you have no idea to fix it when something doesn't work.
Always a good idea to make sure your Hekate is updated as well.
https://github.com/CTCaer/hekate/releases/
And you will want to replace atmosphere\reboot_payload.bin after every time you update Atmosphere (as Atmosphere will overwrite it), replacing it with the latest Hekate payload instead. And keeping it up to date when you update Hekate as well of course. Having an out of date reboot_payload.bin, or letting Atmosphere overwrite it, will lead to rebooting into a black screen or an error message.
Then you can continue launching CFW just as you have been doing. No point in fixing what aint broken, Hekate is just fine and myself and many others are using it. Not sure what that guy's beef with Hekate is. It's incredibly useful to have as a bootloader, for easily dual booting with Android/Lakka, making NAND backups, or booting other payloads easily without having to put every payload you want to use on your dongle (if you use one), smartphone, or PC. Just keep them all on the Switch so they're always easily accessible. And my favorite feature is that you can't accidentally boot sysNAND CFW if you forget to insert your MicroSD card and inject Fusee. Hekate will not boot CFW if it can't find the boot config.
I tried Fusee once, accidentally booted into sysNAND several times while trying to set it up because it was silently ignoring my misconfigured emummc.ini instead of throwing an error, and booted into it accidentally when I forgot to put the MicroSD back in, luckily I had made a NAND backup beforehand so I restored that (just to make 100% sure there is no chance I would get banned for it) and went back to SX OS for a few more months, until I decided to take the time to set up Hekate to launch CFW, which has worked much better for me.
gm