It's a very difficult problem to solve. Once you sign something, it's by design impossible to repudiate that signature. That in turn means you need some other

It's a very difficult problem to solve. Once you sign something, it's by design impossible to repudiate that signature. That in turn means you need some other way of "revoking" or "repudiating" that signature. In the case of TLS for example, it's a certificate revocation list. I don't know if there's such a mechanism on Windows Kernel.