NSS can forcibly set trust bits for certificate chains -- so in theory they could set the codesigning only trustbit. ButI'm pretty sure Windows is not using NS

NSS can forcibly set trust bits for certificate chains -- so in theory they could set the codesigning only trustbit. ButI'm pretty sure Windows is not using NSS as its truststore for those checks. So its up to Microsoft to deal with the de-trusting (which may or may not be modular, I have no idea).