Ladybird is building a browser engine from scratch with no corporate parent, no monetization, and a 501(c)(3) behind it. It also just moved half its engine to Rust with LLM help and lost about a year doing it. Both of those things matter.
Everyone screenshots Autoruns when something's wrong, and everyone misreads the (verified) tag. It proves who signed a file. It says nothing about what the file does, and Microsoft's own Trusted Signing service handed out certificates for ransomware.