I have seen driver installers that just install their own CA. A particularly clever one generated a CA at install time, signed the driver, deleted the private k

I have seen driver installers that just install their own CA. A particularly clever one generated a CA at install time, signed the driver, deleted the private key, then installed the driver, however this relied on internet access during install to timestamp the driver signature. I wonder if this works for kernel mode drivers?