Indeed. Code signing is a perfectly valid technique, and useful, but device owners must be able to control the root of trust. It's when code signing is used to

Indeed. Code signing is a perfectly valid technique, and useful, but device owners must be able to control the root of trust. It's when code signing is used to create a system of manufacturer, rather than device owner control that is the problem. Authenticode seems okay so long as executability doesn't depend on it. But there's a risk Microsoft might interpret it as a vote for "require signing for EXE files" (because the more people use it, the less developers to complain if they require it). If this started to look likely one could always use GPG. Though in practice this shouldn't be possible... there is a very, very long history of binaries which are no longer updated and never will be, so introducing such a restriction is essentially impossible. (Of course, there's no secure way of determining binary date, so grandfathering is impossible.)