The US National Software Reference Library (NSRL) keeps a list of checksums for valid OS files, including all known patched variants:
And this site purports to be a lookup for it (but I'm not sure how accurate or current it is):
I'm not sure if this exactly solves your problem, but it sounds like you're looking for .CAT ("Security Catalog") files? .CAT files are a binary format roughly analogous to an X.509 certificate, except instead of a "subject" they have a list of hash digests. Those digests are the cryptographic "thumbprints" of files, which thus ...
Microsoft provides Certificate/CRL updates offline as well, known as
CTL Microsoft Trusted Root Program Updates
You can download the certificate and CRL updates regularly and update the system.
Below links will be helpful:
Configure Trusted root
Microsoft Trusted root program
authrootstl.cab is generally provided by Microsoft for updates.
But this is not the ...
I do not think so. Forging Code signing signature is infeasible whereas hashes can be updated to match the uploaded binary. If the website, which is providing you, the download is compromised than hashes can also be changed. This is not possible with digital signature and you at least need signing key access.
So, Digital Signature is sufficiently secure at ...