I don't know. I actually asked myself this very thing while typing the above comment, but I'm too busy/lazy to look it up.

One issue I can see with this, though, is that if the malware is already present on your system and can run things, nothing would prevent it from hijacking the modules or the boot image before they're signed.