Artifact Signing: SmartScreen warnings on every release since our certificates moved to EOC/AOC CA 03/04 (fix not effective for EOC CA 04 / AOC CA 04)

Question

We sign our Windows installer with Artifact Signing (Public Trust profile, organization validation) from GitHub Actions. Since April 2026 every release triggers the Windows SmartScreen "Windows protected your PC" prompt on Windows 11, although the signature is valid:

• signtool verify /pa /v: 0 errors, 0 warnings
• RFC 3161 timestamp from timestamp.acs.microsoft.com
• Chain to Microsoft Identity Verification Root Certificate Authority 2020
• SmartScreen "More info" shows our verified publisher name

Nothing changed on our side (same account, same certificate profile, same identity). The only change is the issuing intermediate CA assigned by the service:

• Dec 2025 - 13 Mar 2026: Microsoft ID Verified CS EOC CA 01/02, AOC CA 01/02
• 7 Apr 2026 - today: Microsoft ID Verified CS EOC CA 03/04, AOC CA 03/04 (the intermediates issued on 26 Mar 2026)

Publisher: Raindance, S.L.

Durable identity EKU: 1.3.6.1.4.1.311.97.842021199.393234653.182114792.740699376

Sample file (signed after the June fix announcement):

• SHA256: C5480DF82BBBF969A3762906023610D54713C06767D277F02B3FBCBD5FE4B888
• Signed 2026-09-24 14:37 UTC, issuer: Microsoft ID Verified CS EOC CA 04

In question 5855708 Microsoft stated in June 2026 that the reputation propagation issue for the new intermediates (AOC CA 03, EOC CA 03, EOC CA 04) had been corrected. Our releases signed with EOC CA 04 after that date still show the prompt, and our current release is signed with AOC CA 04, which was not part of that list.

Questions:

1. Is SmartScreen reputation keyed to the durable identity EKU or to the issuing intermediate CA?
2. Can the reputation established for our identity under the CA 01/02 chains be propagated to the CA 03/04 chains, including AOC CA 04?
3. If not, can our certificate profile be re-issued under an intermediate that carries our existing reputation, or what is the supported mitigation?

We have also submitted the file to Microsoft Security Intelligence as a software developer.