At least with the CAs we've worked with, the EV certs are required to either be issued in a CA-provided hardware token or you have to demonstrate positively tha

At least with the CAs we've worked with, the EV certs are required to either be issued in a CA-provided hardware token or you have to demonstrate positively that you have the key in an Hardware Security Module. That's the piece of validation that's really meaningful to me at the EV layer for code signing, and I think it's most of the reason that those are afforded better reputation as well.