How to fix LSA package is not signed as expected event log entries?

If you are seeing LSA errors for packages negoexts, kerberos, msv1_0, tspkg, pku2u, cloudap, wdigest, schannel, sfapm - it looks like you can ignore those, because they are related to password-based SSO, according to this. These specific warnings (they are not errors in the event viewer!) only indicate that something tried loading one of the affected protocols or it was just the general attempt to load the library. According to MS article, this only blocks SSO, not the whole protocols.

It is clear, that for these particular instances it would warrant Microsoft to write a more appropriate warning text, perhaps also indicating what was calling the library or whether it was a general load of the library during boot-up sequence.

I have not found a way to learn what is actually triggering these libraries/protocols, and what can be done to disable them, if that is safe enough for a particular system (because if they are in use, disabling them may affect other apps).

Every time I turn on my laptop, I would press the power button and lift my finger after a couple of seconds to let it "cache" my credential. This way, I don't have to hold my finger again on the sign-in screen. It would sign me in automatically with the data in the "cache". Is this LSA error related to my issue? If not, do you know what should I look for? I believe I got this problem after updating to 22H2.

I honestly don't know. If you have any LSA errors for modules besides the ones mentioned - it can be. If not - most likely this is something else entirely. Can easily be a driver issue even.

Thanks for the pointers around credential guard, which seems to be enabled on my Win 11 Pro PC build.
I also have Core Isolation enabled, especially after seeing a recent YouTube video that showed for gaming purposes (one of my primary uses of this particular PC), it does not impact gaming performance, in some games it improved the performance, but all within acceptable test variance amounts.

Does Core Isolation also enable Credential Guard? They are on the same settings page in Windows Security settings, so I am guessing these LSA errors (negoexts, kerberos and msv1_0 in my event viewer error logs) began showing up after I enabled Core Isolation?

Good to know I can safely ignore these, and Windows is working as intended - Microsoft could do a much better job of their error code descriptions to save the millions of support pages and cumulative millions of hours of their customer's time trying to troubleshoot things that are not security concerns, and just normal Windows operations.
Customer centric or not Microsoft?

From what I understand Credential Guard is separate, but the logic behind it is somewhat similar to Core Isolation, because both use virtualization.

Could it be related to 2 missing entries in the registry of Windows that you should add?

under

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

DWORD:

RunAsPPL value:2

and

DWORD:

RunAsPPLBoot value:2