because eventually, somewhere in the API there must be a way to actually add that cert. The API that&#x27;s being called from windows internally when you press the &quot;OK&quot; button on the warning that&#x27;s normally shown.<p>And even if there was no API or if you do not manage to find its location: At some point, the certificate needs to be stored somewhere. So you just put it there and be done with it.<p>You can try and fight this using stuff like OSX&#x27; new rootless mode, by making a second class of binaries who are more trusted than others, but even then there will always be ways around it and the backlash would be considerable too (there were some very nasty comments about the introduction of the OSX rootless mode, even though it&#x27;s turnoff-able).<p>The only way to prevent this from ever happening is to pre-approve every single app you want running on your platform, but, honestly, that&#x27;s not a platform I would want to use (not that I want to use Windows anyways)