Code signing is the trust anchor of software distribution — and a recurring source of outages when certificates rotate badly, keys are lost, or a signing step blocks a release at midnight. In 2026, hardware-backed keys, cloud signing services and automation have made the process both stronger and calmer.
Centralize key custody
Signing keys belong in a managed service or HSM-backed pipeline, not on a release engineer laptop. Centralization enables auditing, controlled access, and recovery procedures that personal machines cannot provide.
Automate expiry monitoring
Certificate expiry should alert weeks in advance with the renewal procedure attached. The teams that suffer signing outages are almost always the ones who relied on calendar memory instead of monitoring.
Practice the disaster path
Losing a signing identity is unrecoverable for existing app identities; you cannot update an app signed with a lost key. Document and test the recovery and rotation path while you still have time to get it right.
Key storage and ceremony
The baseline is now unambiguous: private keys live in hardware security modules or cloud HSM-backed services, never on build machines or in repository secrets. Access is role-separated — the pipeline can request signatures through an authenticated, audited service, while key material itself requires human ceremony for high-risk operations. Maintain a tested key rotation plan with overlap periods, because certificate expiry discovered during a release is an incident, not a chore.
Automation with guardrails
Automated signing should verify what it signs: hash the artifact, record provenance (who requested, which build, which cert), and sign only artifacts that passed the release pipeline — a signing service that will sign anything presented to it becomes an attacker's distribution channel. The other half is revocation readiness: when a key is compromised, you need the ability to revoke, re-sign and re-publish across channels quickly, which only works if you tracked where every signed artifact went.
Key takeaways
- Keys belong in HSMs or cloud signing services — never on builders.
- Sign only pipeline-verified artifacts; log every signature request.
- Rehearse rotation and revocation before you need them.
Final thoughts
Code signing maturity is measured in the boring rehearsals — rotation, revocation, re-distribution — and teams that practice them convert certificate emergencies into scheduled work.