diff --git a/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/BootstrapperCore.dll b/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/BootstrapperCore.dll
new file mode 100644
index 0000000000..928992c034
Binary files /dev/null and b/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/BootstrapperCore.dll differ
diff --git a/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/System.Web.Mvc.dll b/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/System.Web.Mvc.dll
new file mode 100644
index 0000000000..fb8836398e
Binary files /dev/null and b/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/System.Web.Mvc.dll differ
diff --git a/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/dotnet_realsigned.exe b/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/dotnet_realsigned.exe
new file mode 100644
index 0000000000..1bb188960d
Binary files /dev/null and b/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/dotnet_realsigned.exe differ
diff --git a/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/readme.md b/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/readme.md
index 48b1a83cfe..8380ed4ac4 100644
--- a/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/readme.md
+++ b/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/readme.md
@@ -1,14 +1,21 @@
+## BootstrapperCore.dll
 
-## triple_signed.dll
+WiX binary, signed by .NET Foundation, terminates in a non-Microsoft root (DigiCert).
 
-This file contains 3 Microsoft AuthentiCode signatures and is used to verify CryptQueryObject implementations to
-construct SignedCms objects and extract nested signatures.
+## dotnet_realsigned.exe
+
+.NET host executable, signed with the .NET Authenticode certificate, trusted Microsoft root.
 
 ## dual_signed.dll
 
-This file is dual signed with the .NET Foundation and Microsoft 3rd Party Application SHA2 certificates. It's used to
-test some of the CLI installer logic to verify trusted origanizations.
+This file is dual signed with the .NET Foundation and Microsoft 3rd Party Application SHA2 certificates. 
+
+## System.Web.Mvc.dll
+
+SHA1 signed assembly - valid authenticode, but no longer a trusted Microsoft trusted root.
 
 ## tampered.msi
 
-Signed MSI from .NET Runtime, edited in Orca to change the ProductName in the Properties table which should have invalidated the signature.
+Signed MSI from .NET Runtime, edited in Orca to change the ProductName in the Properties table to invalidate the signature.
+
+
diff --git a/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/triple_signed.dll b/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/triple_signed.dll
deleted file mode 100644
index b58e477a2c..0000000000
Binary files a/src/Microsoft.DotNet.Installer.Windows.Security.TestData/TestData/triple_signed.dll and /dev/null differ