Shouldn't public signature of the hash of the exe file from a known key before execution fix this??? What am I missing?