---
title: "Keep code signing keys in hardware or a · Agent Wranglers"
url: https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/signing-keys-in-hardware
id: DSK-3
level: Required
risk: takeover
updated: 2026-10-22
tokens: 1081
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep code signing keys in hardware or a signing service

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: DSK-3
- Level: Required
- Chapter: [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md)
- Rule: Keep every private key that signs your software in a hardware security module, a hardware token or a cloud signing service. No key exists as a file on a laptop or in the repository.
- Check: A secret scanner finds no `.p12`, `.pfx` or `.pem` signing key in the repository history. The signing service's log lists only the release job as a signer over the last 90 days. A written revocation runbook exists and names the person who runs it.
- Risk: An account or system taken over
- How: Anyone with your signing key can ship malware that every computer trusts as yours. Since 1 June 2023, the CA/Browser Forum has required that public code signing keys are made, stored and used in hardware. Certificates issued since 1 March 2026 last at most 460 days, so plan a renewal each year. Give only the release job access, through a role or a short-lived token, as [keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store.md) says. Guard the Apple and Microsoft accounts that can make new certificates, as [protect the accounts that can change the code](https://agentwranglers.se/playbook/engineering/version-control-and-review/code-host-accounts.md) says. Write down how to revoke a key the day it leaks.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### YAML example

```yaml
# The release job signs through the cloud service, with a short-lived token and no key file
release:
  permissions:
    id-token: write
  steps:
    - run: ./build.sh
    - uses: azure/login@v2
      with: { client-id: "${{ vars.SIGNING_CLIENT_ID }}", tenant-id: "${{ vars.TENANT_ID }}", subscription-id: "${{ vars.SUBSCRIPTION_ID }}" }
    - run: ./sign.sh dist/
```

## Sources

- [CA/Browser Forum, Code Signing Baseline Requirements](https://cabforum.org/working-groups/code-signing/requirements/)

## Related rules

- DSK-2 [Sign every Windows file with a SHA-256 signature and a timestamp](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/windows-authenticode.md) in Desktop apps, extensions and CLIs
- ENG-26 [Keep secrets in a secrets store](https://agentwranglers.se/playbook/engineering/running-in-production/secrets-store.md) in Engineering
- ENG-20 [Protect the accounts that can change the code](https://agentwranglers.se/playbook/engineering/version-control-and-review/code-host-accounts.md) in Engineering
- DSK-5 [Sign Linux packages and the repository that serves them](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/linux-package-signing.md) in Desktop apps, extensions and CLIs
- DSK-6 [Verify every update's signature before installing it](https://agentwranglers.se/playbook/desktop-apps/update-integrity/signed-updates.md) in Desktop apps, extensions and CLIs

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/signing-keys-in-hardware">Agent Wranglers desktop apps, extensions and CLIs playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Sign every Windows file with a SHA-256 signature and a timestamp](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/windows-authenticode.md)
- Next: [Check every signature in CI before you publish](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation/verify-before-publish.md)
- [Signing and notarisation](https://agentwranglers.se/playbook/desktop-apps/signing-and-notarisation.md)