They are, but you have to trust someone. If you install Windows on your machine, you have to trust that Microsoft isn't doing nefarious things to your machine.

They are, but you have to trust someone. If you install Windows on your machine, you have to trust that Microsoft isn't doing nefarious things to your machine. Since you're already screwed if Microsoft is a bad actor, trusting their digitally signed updates doesn't increase your attack surface area. Well, it didn't. The Australian proposal adds Australia to the list of organizations you have to trust to accept updates signed by Microsoft.