SignCheck should be able to verify against a set of known subjects.

[mmitche]

• This issue is blocking
• This issue is causing unreasonable pain

.NET uses its own signing signature (chained to the typical MS Authenticode cert) that we use to sign most of our binaries. These certs have subject names that have meaning to certain tools like Defender. If these change, we want to know and contact the Defender team.

To know when we should perform such an action, I recommend that SignCheck be altered to verify the subject of all authenticode signed files against a known list. If the subject is not in that list, point to a document in Arcade.

[missymessa]

@mmitche are you thinking this should belong in the SignTool epic?