It's a cryptographic mechanism. MS has a private key they apply to each Windows update to mathematically prove A) they're the ones who issued it and B) the content was not modified in transit.

(I am not experienced in cryptography. This explanation might be a little simplistic.)