No, because the attacker renames the file to .jar before sending it to the target. Windows still sees it as a MSI file while doing signature checking. But beca

No, because the attacker renames the file to .jar before sending it to the target. Windows still sees it as a MSI file while doing signature checking. But because it has a .jar extension, the JRE runs it when you double click. Signature verification is done as a independent check, completely separate from execution. Because windows needs to know the signature is valid before even allowing the file to be executed. It also needs to show the signature check in the right-click -> properties dialog.