I find it hard to believe that the majority of Windows system files aren't signed. I don't know whether my disbelief comes from naivety, or because Windows is used within secure environments worldwide and thus one would expect a certain level of care. (Does signing files show care? Probably not.)
But I imagine this lack of signing is the reason why the revocation status of signed runtime binaries aren't checked. Thus, one could have a signed binary which has been specifically revoked for whatever reason, and Windows doesn't care and will let it run. I have tried to enhance this functionality by using AppLocker.
From the website, Microsoft state (http://technet.microsoft.com/en-us/library/ee619725(v=ws.10).aspx):
However, if a certificate was allowed and then revoked, there is a 24-hour period before the revocation takes effect.
Whether this statement refers to "allowing" and then "disallowing" an app using AppLocker certificate rules, or the actual revocation status of the AppLocker binary, I'm not sure but I certainly can't get it working.
This commentary leads me to the question: Shouldn't all vital system files be signed and their CRLs checked before execution (along with specified business app binaries)? Are there software products which will enforce these kind of policies?