This exists, it's not 100% effective because it's generally implemented as a UI flow change where less trusted binaries get scarier "are you sure?" popups and o

This exists, it's not 100% effective because it's generally implemented as a UI flow change where less trusted binaries get scarier "are you sure?" popups and only the most obviously malicious files are blocked. Edge has Microsoft SmartScreen[1], Chrome has CAMP[2] / Safe Browsing and Firefox has a system that also uses Google's data[3]. [1] https://technet.microsoft.com/en-us/itpro/microsoft-edge/security-enhancements-microsoft-edge https://technet.microsoft.com/en-us/itpro/microsoft-edge/sec... [2] https://www.cs.jhu.edu/~moheeb/aburajab-ndss-13.pdf https://www.cs.jhu.edu/~moheeb/aburajab-ndss-13.pdf [3] https://wiki.mozilla.org/Security/Features/Application_Reputation_Design_Doc https://wiki.mozilla.org/Security/Features/Application_Reput... Edit: I missed that part where you were meant pro actively check against publisher provided signatures. The above systems do that only via looking at the code's embedded signature and indirectly via "wisdom of the crowds" style reputation.