title: Is there any reason to not generate page hashes for authenticode signing with signtool.exe?
body: <p>According to <a href="https://social.technet.microsoft.com/wiki/contents/articles/255.forced-integrity-signing-of-portable-executable-pe-files.aspx#Use_the_ph_option_with_SignTool" rel="nofollow noreferrer">this TechNet article on forced integrity checking</a>, there are some circumstances where generating page hashes (the <code>/ph</code> option) is required. There are other circumstances mentioned where pages hashes are recommended for performance reasons.</p>
  <p>Given that generating page hashes is optional, it seems logical to conclude that there must be some possible negative consequence for generating page hashes. However, neither the TechNet article nor the <a href="https://docs.microsoft.com/en-us/dotnet/framework/tools/signtool-exe" rel="nofollow noreferrer"><code>signtool.exe</code> documentation</a> the documentation provides no reasons given for why one would choose not to generate page hashes.</p>
  <p>Are there any possible negative consequences that can come from generating page hashes for Authenticode signing?</p>