Quis custodiet ipsos custodes
In the case where one party is an executable and the other is a certificate, it is not possible to assure mutual verification - hence if A validates B and you need C to validate A.
If we were simply talking about 2 certificates, then mutual authentication is possible as signatures can be added to the entity without changing the signed part. Unfortunately x509 only permits a single signature on a certificate, and given that the trust model isn't really designed to work in this way, there may be complications with the tools to this approach (since at least one signing will require to be done with an unsigned certificate).
But I digress from the problem asked.
A needs to be signed aswell
But for this to to have any value, the signature on A needs to be checked - hence C. And how do you validate 'C' - it's turtles all the way down.
...or at least till the point where it is out of your control, be that because you are constrained by the permissions configured by the admin or the trusted keys in UEFI or a root Certificate Authority (this does not mean that that your admins or hardware vendors or Certificate Authorities are implicitly trustworthy though).
It may be worth noting here that public PGP keys can have multiple signatories which, interestingly, would allow the OS to (within some limitations) validate the hardware as well as the hardware validating the boot OS in a Secure boot - but sadly "Secure boot" uses x509.