"In the case of Stuxnet and DuQu, they used digitally signed components to make their malware appear to be trustworthy applications."

How did they do this? This seems to imply that either

(1) the certification authorities or the (2) vendors of these "trustworthy" software applications were "part of the team".