It depends on how this is implemented. Is it enforced on a kernel level? What if some application, like browser or email client still allows starting an unsigne

It depends on how this is implemented. Is it enforced on a kernel level? What if some application, like browser or email client still allows starting an unsigned .exe file? Is Windows Store protected from publishing malware? Is there real privilege and access separation for different apps?