Signing & submission requirements for an NDIS 6.0 protocol (NetTrans) driver — EV cert + CAB upload?

Question

We have an updated NDIS 6.0 protocol driver (NetTrans class, x64) that runs as a service on Windows 10 (1709+) and Windows 11.

Right now our binaries are WDK test-signed for internal testing only. Before we ship, we need to confirm the correct production signing path.

Could you please confirm:

Do we need to sign the driver with an EV (Extended Validation) code-signing certificate, or is our existing company DigiCert code-signing certificate sufficient?

1. Do we need to create a CAB file and upload it to Microsoft Partner Center for attestation signing so the driver loads on production Windows 10/11 machines?
2. HLK OS coverage (backward compatibility)

We plan to run HLK testing on Windows 11 24H2. If we certify on 24H2, does the resulting Microsoft signature allow the driver to load and run on earlier Windows versions (Windows 10 1709+ and earlier Windows 11 releases)? Or must we test each target OS separately?

1. HLK OS coverage (forward compatibility) Will a driver certified on 24H2 continue to be valid on future Windows releases (e.g., later Windows 11 / Windows Server versions), or does each new OS require re-certification?
2. Exact submission steps Please confirm the exact end-to-end steps required to get our driver Microsoft-signed and shippable, including where HLK and the CAB upload fit in the sequence.

In short: "For a NetTrans NDIS 6 driver that only needs to load on Win10 1709+/Win11 (incl. HVCI), is attestation signing (CAB upload, no HLK) sufficient — or is HLK on 24H2 required? And does one submission cover down-level and future Windows, or is per-OS testing needed?"We have an updated NDIS 6.0 protocol driver (NetTrans class, x64) that runs as a service on Windows 10 (1709+) and Windows 11.

Right now our binaries are WDK test-signed for internal testing only. Before we ship, we need to confirm the correct production signing path.

Could you please confirm:

Do we need to sign the driver with an EV (Extended Validation) code-signing certificate, or is our existing company DigiCert code-signing certificate sufficient?

1. Do we need to create a CAB file and upload it to Microsoft Partner Center for attestation signing so the driver loads on production Windows 10/11 machines?
2. HLK OS coverage (backward compatibility)

Thank you