I think the issue with the Win10 model is that the signature on any PE files is independent so one can use it for some bypass outside of the process of installi

I think the issue with the Win10 model is that the signature on any PE files is independent so one can use it for some bypass outside of the process of installing a driver. That said WHQL/WHLK signatures aren’t useful for bypassing things like smartscreen and do require an additional EV code signing cert to identify the publisher for that. Which again at large scale isn’t probably hard to get.