So does the .msi contain a file length that gets blindly trusted? Or maybe that's part of the signature itself? That's crazy the signature check wouldn't veri

So does the .msi contain a file length that gets blindly trusted? Or maybe that's part of the signature itself? That's crazy the signature check wouldn't verify the file length.