Whose Sign Is It Anyway?

Explore the intricacies of code signing and digital signatures in this thought-provoking conference talk. Delve into the security foundations of software supply chains, questioning the assumptions behind digital signatures and their role in ensuring software integrity. Examine policy choices surrounding key handling, signature validity, and the concept of digital identity. Learn about real-world applications through case studies of The Update Framework (TUF), Uptane, PyPI, and Notary v2. Gain insights into key hygiene practices and the limitations of digital signatures. Challenge your understanding of cryptographic trust and leave with a deeper appreciation for the complexities of secure software distribution.