Code signing certificates are even worse.