Finally got the Windows x64 driver signed correctly. Turns out signtool.exe with the older (NDIS5) version of the Windows DDK does not understand cross-certificates, yet it blithely continues on and signs incorrectly anyway. Got it working by using DigiCert's own certificate tool which includes a sign files operation. Must be done manually but this doesn't have to be done often. F@!K.

ext/bin/tap-windows/x64/zttap200.inf

@@ -0,0 +1,79 @@
+[Version]
+Signature="$WINDOWS NT$"
+Class=Net
+ClassGuid={4d36e972-e325-11ce-bfc1-08002be10318}
+Provider=%Provider%
+CatalogFile=zttap200.cat
+DriverVer=01/22/2014,22.4.22.918
+
+[Strings]
+DeviceDescription = "ZeroTier One Virtual Network Port"
+Provider = "ZeroTier Networks LLC"
+
+; To build for x86, take NTamd64 off this and off the named section manually, build, then put it back!
+[Manufacturer]
+%Provider%=zttap200,NTamd64
+
+[zttap200]
+%DeviceDescription%=zttap200.ndi,zttap200
+
+[ztTap200.NTamd64]
+%DeviceDescription%=zttap200.ndi,zttap200
+
+[zttap200.ndi]
+CopyFiles       = zttap200.driver,zttap200.files
+AddReg          = zttap200.reg
+AddReg          = zttap200.params.reg
+Characteristics = 0x81
+
+[zttap200.ndi.Services]
+AddService = zttap200,        2, zttap200.service
+
+[zttap200.reg]
+HKR, Ndi,            Service,      0, "zttap200"
+HKR, Ndi\Interfaces, UpperRange,   0, "ndis5"
+HKR, Ndi\Interfaces, LowerRange,   0, "ethernet"
+HKR, ,               Manufacturer, 0, "%Provider%"
+HKR, ,               ProductName,  0, "%DeviceDescription%"
+
+[zttap200.params.reg]
+HKR, Ndi\params\MTU,                  ParamDesc, 0, "MTU"
+HKR, Ndi\params\MTU,                  Type,      0, "int"
+HKR, Ndi\params\MTU,                  Default,   0, "2800"
+HKR, Ndi\params\MTU,                  Optional,  0, "0"
+HKR, Ndi\params\MTU,                  Min,       0, "100"
+HKR, Ndi\params\MTU,                  Max,       0, "2800"
+HKR, Ndi\params\MTU,                  Step,      0, "1"
+HKR, Ndi\params\MediaStatus,          ParamDesc, 0, "Media Status"
+HKR, Ndi\params\MediaStatus,          Type,      0, "enum"
+HKR, Ndi\params\MediaStatus,          Default,   0, "0"
+HKR, Ndi\params\MediaStatus,          Optional,  0, "0"
+HKR, Ndi\params\MediaStatus\enum,     "0",       0, "Application Controlled"
+HKR, Ndi\params\MediaStatus\enum,     "1",       0, "Always Connected"
+HKR, Ndi\params\MAC,                  ParamDesc, 0, "MAC Address"
+HKR, Ndi\params\MAC,                  Type,      0, "edit"
+HKR, Ndi\params\MAC,                  Optional,  0, "1"
+
+[zttap200.service]
+DisplayName = %DeviceDescription%
+ServiceType = 1
+StartType = 3
+ErrorControl = 1
+LoadOrderGroup = NDIS
+ServiceBinary = %12%\zttap200.sys
+
+[SourceDisksNames]
+1 = %DeviceDescription%, zttap200.sys
+
+[SourceDisksFiles]
+zttap200.sys = 1
+
+[DestinationDirs]
+zttap200.files  = 11
+zttap200.driver = 12
+
+[zttap200.files]
+;
+
+[zttap200.driver]
+zttap200.sys,,,6     ; COPYFLG_NOSKIP | COPYFLG_NOVERSIONCHECK