Finally got the Windows x64 driver signed correctly. Turns out signtool.exe with the older (NDIS5) version of the Windows DDK does not understand cross-certificates, yet it blithely continues on and signs incorrectly anyway. Got it working by using DigiCert's own certificate tool which includes a sign files operation. Must be done manually but this doesn't have to be done often. F@!K.