It'll be interesting if MS allows to write e.g. WFP callout drivers via LiteBox and not requiring attestation signing. It'll still work in kernel mode, unlike NetworkExtensions in MacOS.