Kelechi Kalu, Software Signing in Practice: Lessons from Adoption and Usability Toward Broader Supply Chain Trust

Software signing is a foundational mechanism for improving software supply-chain security because it helps establish artifact provenance, integrity, and authenticity across organizational boundaries. Yet the security value of software signing depends not only on cryptographic design, but also on whether signing is adopted, integrated, and used correctly in practice. This research examines these…