This seems to be referring to https://docs.microsoft.com/en-us/microsoft-365/security/defe... which would mean that they require the browser itself to be digitally signed, not the JS.