I built the first official Rapid7 Metasploit QA program, so perhaps i can be of assistance.
Yes, it is seemingly impossible to create VMs for all modules. There's a lot of them. Luckily for you, nobody uses most of them. I'd focus on the top 50. You should clarify what type of signature you're trying to build (AV, IDS, etc) or at least the perspective of the attack you'd be able to see. For this exercise, i'll assume you're on the network.
You can capture at least the initial sig of the attack without a victim, assuming a remote exploit, in some cases this would be enough. Client sides are a little trickier, mainly because there's built-in targeting in many of the modules that will prevent an exploit from being sent if certain conditions aren't fulfilled.
We solved this at R7 by focusing on the top exploits and aux modules, and by building VMs that could be used in testing. We toyed with the idea of replaying traffic from the victim, which would allow us to remove it from the equation, but never got that far. It's only an optimization anyhow, as you still need to capture the initial interaction in order to replay it.
In short, you have to get your hands dirty and understand what the module's doing in order to quickly build signatures. Sorry there's no easy answer :/.