i can check the cbCabinet (DWORD) from cab header:
if (cbCabinet < size of cab file) => file is signed
the aim behind is to not install unsigned cab's (im using wceload
programmatically in silent mode) and i dont found a location to set policy
for SECPOLICY_UNSIGNEDCABS ... (using wince 5)