Comment by AtNightWeCode

The core problem is that VScode extensions does not need to be signed at all. Mind boggling stupid design decision.