Signing something isn't proof that it's legitimate. Signing something is just proof that you control the means to be able to sign something cryptographically, h

Signing something isn't proof that it's legitimate. Signing something is just proof that you control the means to be able to sign something cryptographically, hence the problem of compromised keys. DMA attacks anyone?