Just to put further context on one of my points - if I upload an unsigned webapp.exe from weborder, virustotal has hits on 10 out of 70 and if I sign it and run again that is reduced to 3 out of 70.