> But if we've already installed a driver, then we must have received its signature before T, otherwise we wouldn't have installed it at the time. So we should

> But if we've already installed a driver, then we must have received its signature before T, otherwise we wouldn't have installed it at the time. So we should still continue to trust it after T. And now you leave open an attack surface of "forge a signature off an old, expired cert and then fool the OS into thinking it's been installed all along."