After creating a certificate exception in the exception policy, Auto-Protect no longer detects files signed by that certificate, but scheduled or manual scans of compressed files will still have detections.
This is by design. A certificate exception will not work on certificate-signed files inside compressed files.
CRE-12031