I'm not sure if this exactly solves your problem, but it sounds like you're looking for .CAT ("Security Catalog") files? .CAT files are a binary format roughly analogous to an X.509 certificate, except instead of a "subject" they have a list of hash digests. Those digests are the cryptographic "thumbprints" of files, which thus do not need to directly bear a signature (and often can't, because they're a file format that doesn't have a location for one). The other parts of the catalog are very similar to those of a cert: there's metadata about the catalog (including a validity date and some identifying info), and there's an issuer signature (signed by a Microsoft signing key, in this case).
You can think of security catalogs as a self-verifying collection of detached signatures, except of course there's no need to actually sign every file (just hash it) because you can't modify the contents of the catalog without invalidating its own signature. Windows has tools to work with security catalogs, including a built-in viewer program and a tool to create them that is distributed with the Windows SDK. The components of Windows that implement signature validation (even if they don't necessarily enforce it) can use a security catalog in lieu of an attached signature.
Somewhat inconveniently, I don't know of either a way to tell, from a given file, where its associated security catalog might be (other than "try the same folder, or any subfolder called "catalogs", or lacking that any .CAT file in the same branch of the folder hierarchy"). Nor do I know of tools to parse security catalogs directly, though I wouldn't be at all surprised if they're ASN.1 encoded as CER or DER, just like most certificate files. There is at least some support for security catalogs in PowerShell, which implies you might be able to script the operation "[obtain] a list of checksums of Microsoft-published OS files" without needing third-party tools. Note that you'll possibly need to check a lot of them - there are over 6000 .CAT files under my \Windows directory alone - though I think a lot of those are for updates, legacy versions of various libraries, and in-box drivers that I have perhaps never used.
Incidentally, the existence of security catalogs probably addresses your surprise at so many Windows files being (seemingly) unsigned. Rather than having attached signatures - which are possible for PE-format binaries but not always ideal, and not possible for many other file formats - a single signed file stores the hashes for a large list of files (of arbitrary format), effectively signing every one. It's just not obvious that this is done, or where to find that file.