How does package signing usually work on Windows?

Over the last few days I've been getting Emacs working on Microsoft Windows. I haven't done that for a few years and some things have changed.

I noticed something that puzzled me. I installed MSYS2 to get some of the utilities. When I did that an error occurred in M-x list-packages because of GNU GPG path problems. This is a known problem, see this thread: https://www.reddit.com/r/emacs/comments/ymzw78/windows_elpa_gnupg_and_keys_problems/ . The underlying cause is that MSYS2 installs a version of GNU gpg which requires MSYS2 style paths. Emacs sends it Windows paths which it can't understand. The solution is to install a port of GNU gpg for Windows.

Here is another thing that works, but it seems like it shouldn't. If you remove MSYS2 from the PATH environment variable then packages work and install fine. This puzzles me. How does list-packages work without gpg? Does it just do no signing at all? Or does it use some sort of microsoft signing infrastructure?