Comment by uep

> You already need compromised systems to install malware, signed or not. Not a real problem.

Is this true? Ads pointing to a malicious Notepad++ is already an existing thing. Now their malicious version will pass signing checks. Users will happily install these without the system itself being compromised.