Okay, 3 update-reboot cycles later, still no certificate.
This was both using Dell's update utility and Windows Update.
So either they've been caught out and stopped it (and so this machine dodged a bullet), or they've been shipping select machines with this dodginess preloaded.
Biting the hand that feeds IT
