Why would they have to forge it? They can simply install a version that isn't signed on your system via an update.

Then later replace it with a signed version once they have the data they wanted. You would never know what happened.