I also noticed that various dependencies (like modelcontextprotocol.dll) aren't Authenticode signed either, but I'm not sure what the expectations are around that.