cristalink wrote:
Besides, it is relatively easy to install an unsigned driver silently
> anyway, without interfering with signature checking.
> Don’t ask me how, I won’t tell.
Of course - if you know what the system does with your driver, it is
obvious. (If you don’t, go play elsewhere.) 
Unfortunately, this is too far from being convenient. What’s easier -
> click Continue Anyway or install a certificate?
For an “end-user” it is easier if their admin installs a certificate
beforehand.
(But I learned we don’t talk about “end users” - sorry, my fault.)
Example:
If you have a USB device and plug it in at a different port, you need to
install its driver again. IMHO this is pretty ugly(*1) for PnP devices.
Your admin probably wants to install a certificate, if you’re in a
company with a “no-admin-account-for-users” policy.
-H
(*1) Read “braindead”.
Well, for testing this is of course great, e.g. if you use different
driver classes you can actually have the same device with different
driver technologies running on the same machine, e.g. a WDM driver on
USB port A and with a WUDF driver on USB port B.
Iff this was a special ‘test mode’ you can enable, this would be OK.
From a system perspective it is of course an unnecessary nightmare -
the “other port install” can/does actually overwrite the common driver
binary, thus possibly changing behavious also for the other ports.