drop signed binary + cert chain export · parse publisher + timestamp + eku · runs locally
drop signed binary + cert chain export · local only
heuristic screener · vendor schema varies · not definitive proof