I have built my own version of the OpenVPN TAP driver (NDIS5) and have to package it with my application. From the anniversary update of Windows 10 (1607), Windows is supposed to reject the signature of kernel mode drivers NOT signed by Microsoft except in certain circumstances.
The driver is correctly signed with a new EV cert from Digicert. It's a new installation of Windows 1607, not an update. Secure Boot is on. Why is Windows accepting it?
From the Microsoft docs, I had expected to have to go through the hardware developer portal to have my driver approved by Microsoft.