A signed vendor update is later found to contain malicious code. What does this show about signature…

Question

A signed vendor update is later found to contain malicious code. What does this show about signature verification?

Accepted Answer

B. Verification proves origin, so build pipeline integrity is a separate requirement — If the pipeline is compromised, the malicious artefact is genuinely signed and every downstream check passes.

Answer

The signature must have been forged

Answer

The certificate authority is liable for the content

Answer

Signature checking should be disabled for vendor updates