Damn, trying to post this was a drama.

Windows 11 x64 24H2

Taking a recently updated game from my library https://www.gog.com/en/game/hive_jump_2_survivors

I see this https://i.imgur.com/cATiPWw.png I see this for any game using this newer certificate.

How does this get resolved?

Install it anyways? It's not like GOG is going to host virus laden installers.
If in doubt, run the file through a virus scanner or three beforehand then install away.

I launched an offline installer signed October 21st and it was fine.

Run a Windows Update check and make sure you're not blocking any relevant Windows processes, like LSASS.exe which checks for certificate revocation. If needed, there are convoluted and tedious ways to manually update root certificates and the certificate trust list. It's also worth double-checking that your system's date and time are accurately set.

I've found the issue, though it's a two stage problem. Not everyone might have the second issue but the first should be consistently reproducible

Part 1:

Here is the behaviour on a Windows 11 23H2 x64 vm. The issue is present by default but can be resolved with no need to update root certificates, by replicating the behaviour in the video:

https://streamable.com/en437t

As soon as I view the certificate it get's added to the intermediary trust section and then it works as normal.

Until I view it, the publisher will remain unverified. This is a consistent and reproducible on a fresh install of Windows 11 x64 23H2 or newer.

Part two: If the the cert was already present in the intermediary trust section

On my main PC the certs were already present and the binary would never show publisher verified so the above behaviour would not solve the issue.

Note: I've updated my main root trust to see if it fixed anything as a stand alone action but this does not need to be done at any stage to resolve this.

I have the full chain of certs installed. The required chain is shown in this image.

https://i.imgur.com/6cx0bT9.png

Here is the problem intermediary trust cert.

https://i.imgur.com/uA79Xpv.png

If I open Certmgr.msc and delete this intermediary trust cert, then repeat step 1, it was re-added automatically and the binary publisher is now verified.

I cannot explain why it was broken and it needs to be removed then re added. I have verified my system integrity and no other issues.

This is how you solve the issue for this certificate:

Issued to: GOG sp. Zo.o
Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Valid from 07/03/2024 to 20/03/2025

https://i.imgur.com/gErRTPD.png

I don't know, i only tested on Windows 11 23H2 or newer.