https://news.ycombinator.com/item?id=8203164 https://news.ycombinator.com/item?id=8203164 > These attributes are not part of the signedAttributes which is used

https://news.ycombinator.com/item?id=8203164 https://news.ycombinator.com/item?id=8203164 > These attributes are not part of the signedAttributes which is used to actually authenticate the signature https://learn.microsoft.com/en-us/archive/blogs/ieinternals/caveats-for-authenticode-code-signing#cheating-authenticode https://learn.microsoft.com/en-us/archive/blogs/ieinternals/... > unverified data within the PKCS #7 blob itself which will not be taken into account when verifying the Authenticode signature