An insider got them access to a trusted signing certificate would be my first guess.

PKI remains a pain in the ass and very few organizations do it well.