How can a rootkit bypass Windows 7 operating system's kernel mode, code signing policy?

Defeating a scanner from detecting code changes describes anti-forensic obfuscation, not a technique for bypassing the kernel code signing policy.

Replacing system calls describes kernel hooking, which happens after the OS loads and would still be subject to code signing and PatchGuard checks.

Replacing real applications with fake ones describes user-mode trojan behavior, which does not operate at the kernel level and does not bypass code signing.

By embedding itself in the Master Boot Record, a bootkit executes during the pre-boot phase before the Windows kernel and its code signing enforcement mechanisms are initialized. This allows the rootkit to modify the boot sequence and load unsigned or malicious kernel-mode drivers that PatchGuard and Kernel Mode Code Signing would otherwise block. Because Windows security policies have not yet been loaded at MBR execution time, the bypass is structural rather than a software exploit of those policies.