They didn't "give the keys", they have a signing infrastructure that is meant to be used for validating organizational identity and origins of code. They have a

They didn't "give the keys", they have a signing infrastructure that is meant to be used for validating organizational identity and origins of code. They have a quality checking system, but it's only required for certain levels of Microsoft backing. I think it used to be called the Windows Logo Program or something?