The way it's meant to work is that the revocation date of a certificate is stored explicitly, and signatures are timestamped so you continue trusting signatures

The way it's meant to work is that the revocation date of a certificate is stored explicitly, and signatures are timestamped so you continue trusting signatures that pre-date that revocation date. Because that's supposed to be the moment the private key behind the cert became leaked or untrustworthy. However, Microsoft aren't doing this (their code signing ecosystem is frankly a mess compared to Apple's). Instead they're ignoring the timestamps in the signatures and breaking old binaries. Not cool.