The AppHost package carries satellite assemblies from the main vs-mef assembly. These are not authenticode signed but should be.