Secure code signing in 2026: keep signing keys in an HSM or vault, sign Authenticode, JAR, Git commits, container images and firmware remotely, under approval.
A code signature tells a device, an operating system or a user that a binary comes from you and has not been modified. That promise is only as strong as the protection of the signing key. A key in a file on a build server, in a CI secret or on a developer laptop can be copied, and a copied key signs malware that every one of your devices will accept.
This guide covers why signing keys belong in a non-exportable store, how remote signing works with the standard tools, what to sign (firmware, Windows binaries, Java archives, Git history, container images) and how DuoKey's code signing service implements it.
With a non-exportable key, the private key never comes to the build machine. The build hashes the artefact, sends the digest (or a small payload) to a signing service, the vault or HSM signs it, and the signature goes back to the standard tool, which embeds it in the file.
Only a few bytes cross the network, so remote signing is fast even for large binaries.
| Artefact | Typical tool | Why it matters |
|---|---|---|
| Device firmware and update packages | Detached signature checked by the bootloader or update agent | Only authorised firmware boots or installs |
| Windows executables, drivers, installers (EXE, DLL, MSI, CAB) | Microsoft SignTool (Authenticode) | SmartScreen reputation, driver loading, enterprise policy |
| Java archives (JAR) | JDK JAR signing | Integrity of Java applications and plug-ins |
| Git commits and tags | Git SSH signing | Proves who changed the source, end to end |
| Container images | Sigstore cosign | Admission control in Kubernetes |
DuoKey's code signing service is part of DuoKey PKI. A code signing application binds one non-exportable vault key, optionally a code signing certificate chain, and optionally an approval policy. Build machines and developers send a digest or a small payload to the signing API; the vault signs it; the signature goes back to the standard tool. The key never leaves the vault or HSM.
Supported tools
| Use | Tool | How it signs |
|---|---|---|
| Authenticode (EXE, DLL, MSI, CAB) | Microsoft SignTool | signtool sign /dg writes the digest, the DuoKey client has the vault sign it, signtool sign /di embeds the signature |
| Java archives | JDK JAR signing engine through the DuoKey JAR signer | The JDK builds the signature block; DuoKey performs the signature operation |
| Git commits and tags | Git SSH signing (gpg.format=ssh) with the DuoKey client as gpg.ssh.program | OpenSSH signature made with the application key |
| Container images | cosign generate / attach signature / verify | The signature payload is signed through the DuoKey client |
| Firmware and any detached signature | Any tool that can sign a digest or a small file over HTTPS | The DuoKey signing API |
Security model
The same platform issues the device certificates that verify your firmware: see PKI for IoT and secure over-the-air updates.
A key generated inside an HSM, a cloud KMS or a vault with export disabled. Applications can ask it to sign, but nobody, including administrators, can copy the private key out.
For publicly trusted code signing certificates, the CA/Browser Forum requires a hardware module or an equivalent cloud service. For private keys that sign firmware or internal software, a non-exportable vault key gives the same protection against copying.
Compute the firmware image digest in your build, send it to the signing service, and attach the returned signature in the format your bootloader or update agent verifies. With DuoKey, the signing API returns the signature for any digest, under the application's approval policy.
Yes. A DuoKey code signing application can require each signature to be approved under a quorum policy, which suits release signing with production keys.
The CRA requires manufacturers to protect the integrity of software and security updates. Signing updates with protected keys, and verifying them on the device, is one of the standard ways to meet that requirement.
Written by
DuoKey Team
Related Resources
Tell us where control is difficult today. We will help you identify a practical next step.
