The uncomfortable economics
A code-signing certificate from a public CA is a time-boxed identity with hardware-key custody and renewal cycles. On a preview cadence — rebuilds daily, re-issues often — teams that sign anyway either ship with test certificates (destroys the chain-of-trust idea) or delay builds while cert ops catch up. The coherent alternative: keep the preview unsigned, make the hash the handshake.
The protocol we run
- Every candidate MSI emits with a manifest JSON naming the exact SHA-256, build gate results, and payload inventory.
- The landing page restates the hash with a Copy button so comparisons are copy-paste, not transcription.
- Your side:
(Get-FileHash …).Hash, paste-match, irreconcilable = discard. No “looks fine.”
What changes at public release
Signing arrives with the first public version. UpgradeCodes remain stable so preview builds upgrade into signed releases cleanly; the signature verification story changes, your files don't. The trust lecture you exercised on the preview isn't wasted — it's the same hash discipline many teams keep even when signed, when validating mirrors.
ProofTune ProjectEngineering notes — every claim here names the bytes a real tool touches. Verify first, install second.