It&#x27;s certainly an interesting problem. Suppose that an program that needs administrative permissions depends on lib.dll. Should lib.dll have to be bundled with the application and signed with the same key? Why not statically link at that point then?<p>Since the libraries the application might pull in might not even be available before runtime would you prompt for each load? Maybe prompt for each load that isn&#x27;t in a system directory -- implying that there isn&#x27;t prior trust?<p>You could embed the key the library developer signed the library with but then we have a key revocation problem and updating the library might require updating the application and business critical applications might hold entire departments back from getting security fixes.<p>I don&#x27;t think this is really a problem with DLLs or the signature process, but that the old installer tries to load any library in the executable directory.