Windows signing keys are often protected by hardware security modules (often on USB devices), so you can't push them to GitHub repositories. Malware authors sp

Windows signing keys are often protected by hardware security modules (often on USB devices), so you can't push them to GitHub repositories. Malware authors spend a lot of time trying to steal signing keys exactly to try and avoid AV detection, so it's not worthless. It's certainly not easier for criminals to get one than honest developers.