[snuxoll]

But not by Microsoft, you can opt to obtain WHQL certification for your driver and have MS sign them - but it's also acceptable to get a code signing cert from any trusted CA.

Apple controls all the keys for macOS, AFAIK there's not even an option to add additional CA's for code-signing trust. To get around this you have to completely disable SIP, and it's rather stupid to tell users they must disable a well-meaning (if somewhat poorly implemented) security feature to install a kext because Apple doesn't like you (no knowledge if this has happened, but it can, and I don't care for that).