OK. The issue arose because the expired certificate wasn't countersigned by a timestamp server. So many comments agree that (a) security is hard, (b) countersi

OK. The issue arose because the expired certificate wasn't countersigned by a timestamp server. So many comments agree that (a) security is hard, (b) countersigning with a timestamp server is easy to miss, (c) countersigning makes build processes difficult, and (d) they've done or seen similar things in other apps/companies. This sounds like a classic UI/UX issue for developers around a literally mandated and mission-critical requirement of the OS. At the least, MS should provide a validation tool to surface errors or risks before production. Better, signtool.exe should make omissions (like a timeserver) very difficult and make them an override, not a default. Best, they would do both. I don't agree that the OS should reject non-timestamped signatures as faulty per se (and throw an error), as that puts the burden on the user to understand a developer's mistake. Sometimes running without a timestamp may be desirable - ultimately that's the dev's choice. It should just be a choice made explicitly.