Microsoft does this with drivers since Windows 10 (attestation singing). I think this is okay, since users hold Microsoft responsible if the kernel crashes and

Microsoft does this with drivers since Windows 10 (attestation singing). I think this is okay, since users hold Microsoft responsible if the kernel crashes and this at least gives them the possibility to investigate. Signing apps with normal (EV) code signing certificates is the best we have for other apps, I think. If you detect malware signed by a a certificate you blacklist that one and foward information to the relevant criminal authorities. If they don't investigate you blacklist the whole country. That last step is probably the most controversial one, but otherwise you still have a malware problem.