Matthew Garrett

At some level, any anti-malware code has to trust the services provided to it by the operating system. If the operating system has already been compromised before the anti-malware code can be executed, you've lost. The attack this is intended to prevent is the one where a compromised system modifies early parts of the boot process such as the bootloader and uses that to backdoor the entire OS. If each component you execute before loading the anti-malware code is signed, you have a much stronger expectation that the OS will behave reliably when asked about things like "Does this file exist".