They recently broke hwid, but was recently fixed as of 2.2. The other method worked fine still

Meh. I pondered this but leaving it helps users still using the platform.

And that’s why certificates can be revoked, that’s the whole point, trust. It only costs a few hundred a year per Microsoft’s documentation and approved vendors so it doesn’t seem that much of an ask. At the very least you can look up the developer yourself, harder to do if the package has no identity associated with it