While it's true that the NSA could feasibly compel them to do this, I would be reasonably surprised if they exerted that capability so casually that this many e

While it's true that the NSA could feasibly compel them to do this, I would be reasonably surprised if they exerted that capability so casually that this many ended up uploaded in e.g. VirusTotal. If everyone thinks random signed drivers can be malicious, then they're more cautious about them, looking for them. If everyone thinks signed drivers are a sign of trustworthiness, it's much more likely that your malicious driver can wind up where it needs to be, and stay there without being noticed. My personal bet is heavily on malware getting signed either through a stolen cert/compromised signer or simple incompetence.