I'm working on a product that includes 3rd party drivers for some of the product's hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.
Given that getting new, sha2 signed (or dual signed) drivers from all the 3rd parties is going to be very difficult, if not impossible, should I sign the drivers I have with my company's code-signing certificate?
What are the implications, both technical and legal, in signing someone else code? Does it confer more than just "we've tested this version of the driver and trust it"?