Until recently, the Sysinternals executables was signed with a Microsoft certificate but the drivers inside Process Explorer was still signed under the old pre-acquisition certificate (I think they actually even renewed it too)!