Yes it's just a signal to AV engines, not a whitelist. Windows Defender is quite respectful of it. Something that can increase the risk of FPs is mixed signing.

Yes it's just a signal to AV engines, not a whitelist. Windows Defender is quite respectful of it. Something that can increase the risk of FPs is mixed signing. Like, not signing every DLL and EXE in the program with the same certificate, not signing the installers/packages, only signing the installers/packages and not the contents, etc.