Regarding the malicious drivers getting signed, Microsoft says activity was limited to the abuse of several developer program accounts and that no compromise has been identified. "We’ve suspended the partners' seller accounts..." (hat tip to @ryanaraine for pointing to Microsoft's statement) https://msrc.microsoft.com/update-guide/vulnerability/ADV220005