Trusted timestamp services. https://en.wikipedia.org/wiki/Trusted_timestamping

Microsoft's Authenticode has been doing this for a long time, allowing a signature to be considered as valid long after the signing certificate expired.

https://learn.microsoft.com/en-us/windows/win32/seccrypto/ti...