@robmen : What's verified if SuppressSignatureVerification="no" and there's no Authenticode signature? Does it fall back to the hash?