Doesn't really help when the signing of the shim is the same problem... and no, we don't want to get a 2nd job as a shim signing service. Also, as you pointed out yourself: it would be rather tedious work since absolutely every device functionality would need to be passed by the shim to the "external implementation". Leaving out anything would cause trouble.
Overall we'll look into this signing topic as soon as we can - but right now we can't spend time of the developers who could make an impact in this area, because it's fully booked out with release critical work. Sorry.
Discussions related to using the OSE version of VirtualBox.