SignCheck doesn't seem to detect unsigned burn bundle engine

It doesn't look like SignCheck catches bundle installer engines not being signed (although it does catch MSIs not being signed):

```
#> Microsoft.DotNet.SignCheck.exe -i *.exe -r
Starting execution of SignCheck.

Results

[File] dotnet-runtime-3.0.0-preview9-19420-02-win-x64.exe, Signed: True
[File] dotnet-host-3.0.0-preview9-19420-02-win-x64.msi, Signed: True
[File] dotnet-hostfxr-3.0.0-preview9-19420-02-win-x64.msi, Signed: True
[File] dotnet-runtime-3.0.0-preview9-19420-02-win-x64.msi, Signed: False [Error] HRESULT: 800b0100 (No signature was present in the subject)
[File] windowsdesktop-runtime-3.0.0-preview9-19420-02-win-x64.exe, Signed: True
[File] windowsdesktop-runtime-3.0.0-preview9-19420-02-win-x64.msi, Signed: False [Error] HRESULT: 800b0100 (No signature was present in the subject)

There are unsigned files.
Total Time: 00:00:17.2721501
Total Files: 588, Signed: 500, Unsigned: 2, Skipped: 72, Excluded: 14, Skipped & Excluded: 0
```

@joeloff is this expected? Is it possible to check the engine?

Related: https://github.com/dotnet/core-setup/issues/7817. (Although Core-Setup ~doesn't~didn't have signing checks enabled yet, so having this feature wouldn't have helped with that *specific* issue. :smile:)