Signature revocations are functionally equivalent to malware definitions and correspondingly don't actually require code signing.