I'm working on a product that include 3rd party drivers for some on the products hardware. Some of the drivers are not signed, others are only signed with sha1 certificates.

Given that getting new, Sha2 signed (or dual signed) drivers from all the 3rd parties is going to be very difficult, if not impossible, should I sign the drivers I have with my companies code-signing certificate?

What are the implications, both technical and legal, in signing someone else code? Does it confer more than just "we've tested this version of the driver and trust it"?