The Redmond giant wanted only cryptographically signed executables, ideally those obtained from the official Windows application store, to run on its hardware.
He built the technology needed to take all executables off the wire, and essentially unpack and run them in a mini-cloud of virtual emulators on a hardware appliance.