We currently use WinVerifyTrust to validate in-binary Authenticode signatures, but this doesn't work for externally signed binaries (i.e., those that come with a separate .cat file). Many core WIndows binaries are signed externally, so we should support this case.

Some initial research:

• https://stackoverflow.com/questions/7241453/read-and-validate-certificate-from-executable

MSVC on Windows prepends padding instructions to functions for alignment (it currently uses the CC opcode for this and a 16-byte alignment for all functions by default). We currently preserve those instructions as "gap functions", but they should be safe to discard. We could add a pass that scans all gap functions and trims them by removing all CC (and even 90 as well) opcode.