See "Acquiring prohibited firearms": https://rcmp.ca/en/firearms/classes-firearms/classes-firearms-canada
There are specific exemptions that can be applied on top of a PAL to acquire prohibited firearms. For example, law enforcement is allowed to carry handguns.
Code signing certificates work a little differently than SSL certificates. A timestamp is included in the signature so the certificate only needs to be valid at the time of signing. The executable will remain valid forever, even if the certificate later expires. (This is how it works on Windows)