When a software company sends me 1 file and asks me to install it then I check the signature and it is valid under the Cert (issued by Thwate CA). So is installing that file sent by that company safe? I mean:
- Is there any chance a malicious superuser can alter that file?
- If I don't know that company, should I install it? When signing the file, does CA check that file or they just signed it and didn't care whether the file is harmful for receiver or not? Sorry for gramma mistakes, I am not English speaker.