Can you actually do that? I was under the impression that the kernel driver root certs aren't under user control, and you basically have to boot your Windows in debug mode to run an unsigned driver. Surely people would just self-sign instead if that was possible.