Why bother checking the signature of dependencies if the main executable integrity isn't being checked?
What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.
Yep and sometimes the name people know isn't the name that a CA will permit in a certificate. I have one of those. I'm known as a shortened version of my middle name, say Jack Quimby, but DigiCert and others insist that the cert be issued to Alphonse Jackson Quimby, Jr.
OK I'll just buy an LLC from a state that's cheap (never mind the paperwork) but that's no good either because the new entity had no listed phone number...
When I bought code signing certificate for my LLC, in their infinite wisdom CA put "Spółka z ograniczoną odpowiedzialnością" as CN, because that's what they saw on proof of ownership. "Spółka z ograniczoną odpowiedzialnością" literally means "Limited liability company" in Polish.
Redhat is an example of a company that makes money on top of extensive open source contributions. I doubt a similar model would work for a text editor. There is a reason most open source projects like this have a corporate benefactor.
What really surprises me is that the author of something as great as Notepad++ isn't making enough money from the project to easily be able to pay for the certificate.