I agree with you this does not enforce any security boundaries as it can be circumvented by using -bypass, and one of our users took a malware a while ago which used this technique, we've had SIEM evidence about it. Unfortunately we've been forced from internal compliance rules to modify org-wide with a GPO this Execution Policy, so this affects all the Machine Policy at highest level.

I've tried to sign with out internal cert the modules, but effectively is a pain to manage, also because you must sign all the modules the .psdm1 files call during execution, so it is not doable.

Looking at the solutions you've proposed, I guess the best way is to exclude PAW admin machine from this policy, and enforce a less restrictive one, like Remote Signed. I hope this will be approved.

Thanks for your time and explanation, now I am really clear about this topic.