Just downloaded pgadmin4-4.26-x64.exe from the official web site. When I go to install it comes up with an "unknown publisher".
Is this legit?
I'm seeing that too - there doesn't seem to be a digital signature on the installer.
So to the original question, yes, it is legit. The certificate expired :-(
I have to wonder a) how that happened without the build failing,
That happened because all our build scripts will ignore certificate not found type errors, throwing out a warning to the (very long) build log instead. Microsoft's tools don't give a separate error for expired certificates - they have a generic "No suitable certificate found" one.
It does it that way because individual developers don't have code signing certificates (they're expensive, a pain to get, and we don't want random ones with our name on them in existence, or to have lots of people with access to the one we use). Obviously the developers need to be able to build, even though they don't have a CSC.
