> OK. You literally said:

Yes, and I didn't call it a "kernel rootkit" as you said I did.

> How would a signature system would have prevented a malware that was literally signed by Lenovo _and_ MS from being preinstalled on a Lenovo OEM image ?

Because AFAIK Device Guard sets limitations to what WPBT can do. Not to mention it's likely that additional kernel and boot integrity helps against all types of malware.

Superfish was never shipped with WPBT (it was preinstalled), so please do make explicit which malware you are referring to.