[ksk]

> Microsoft should respect your decision and allow you to persist that decision for that driver, even if you reboot and turn verification back on.

If you have a whitelist, then malware authors would ship a primary driver that is signed and "clean". This clean driver just changes the whitelist so other malware can be executed without signature checks. I would suggest you first model the threat, model your response and analyze the different approaches.