Why must a developer's code-signing certificate be added to "Trusted Publishers" even though the company CA already issued it?
A trusted chain only proves who signed; AllSigned additionally asks whether you want to run code from that publisher, and only certificates in the Trusted Publishers store run without that question.
Windows separates two questions:
- Is the signature valid? The certificate must chain to a trusted root, be valid and have the code-signing EKU. The company CA already guarantees that.
- Do I want code from this publisher? That is answered by the Trusted Publishers certificate store. Under AllSigned, a script from a publisher not in that store triggers a prompt ("Do you want to run software from this untrusted publisher?"), which blocks unattended use.
Deploying the certificate to the store with Group Policy makes the decision once, centrally: export the developer's code-signing certificate (Base64, without the private key) from the CA, import it under Computer Configuration, Policies, Windows Settings, Security Settings, Public Key Policies, Trusted Publishers, run gpupdate /force, and check in certlm.msc (the local computer store) that it arrived.
This is an allowlist of individuals, more specific than "anything the CA ever signed". A certificate the CA issued to someone else for code signing is still asked about.
Go deeper:
Microsoft Learn: about_Signing — how PowerShell treats trusted and untrusted publishers under AllSigned.