ActiveX
No execution-time protection.
Sole security is digital signature.
- Is the provider really trustworthy?
- Was the provider hacked?
- Has the user correctly validated the certificate chain (I.e., MICROSOFT.COM vs. MICR0S0FT.COM, or NASA.GOV vs. NASA.COM)?