Can Microsoft revoke their signatures on kernel drivers? If so, why haven't they revoked Genshin Impact's anti-cheat driver now that it has been proven to be a vulnerability? Is there a technical reason, or purely business?

It's a very difficult problem to solve. Once you sign something, it's by design impossible to repudiate that signature.

That in turn means you need some other way of "revoking" or "repudiating" that signature. In the case of TLS for example, it's a certificate revocation list.

I don't know if there's such a mechanism on Windows Kernel.

Whoa, that's a really scary example that would be great to point people to to show why this stuff is so bad. Can you link to more info about this?

Here's a PoC for it on GitHub, you can read the code, it's pretty much just an IOCTL for each operation. Check Driver/MhyProt2.cs.

https://github.com/kagurazakasanae/Mhyprot2DrvControl

Yikes! Thank you!