In Windows software signing, the notBefore/notAfter specifies when the app has to be signed. If the certificate (or issuing certificate?) has a certain magic fl

In Windows software signing, the notBefore/notAfter specifies when the app has to be signed. If the certificate (or issuing certificate?) has a certain magic flag, which most do, the signature will be valid forever as long as it was made within the validity window. To know whether the signature is made within the validity window (or at least, not backdated), a countersignature from a timestamping service is added. If the countersignature or the flag in the cert is missing, an expiring cert will prevent the application from starting (Mumble had that problem), but if both are present, the signature is valid forever. No idea if OSX handles it the same way, but it would make sense if they did.