From memory adding a valid but unchained signature to a binary will change how SmartScreen initially evaluates your application. If there's no signature at all

From memory adding a valid but unchained signature to a binary will change how SmartScreen initially evaluates your application. If there's no signature at all you get a yellow box or at least a message that is more alarming than if there is a valid signature even if unrecognized. Similar thing for the script signing policies -- during my testing the default seems to want a signature, but not a valid chained one. I was confused in the same way you are, but the documentation doesn't actually say you need a valid chained signature nor does it really describe the threat and security models. They just have signatures, because signatures make things more secure, right?