AWS KMS

The private keys of the code-signing certificate can be stored in an HSM to eliminate the risks associated with stolen, corrupted, or misused keys.

Client-side hashing ensures build performance and avoids unnecessary movement of files to provide a greater level of security

The command line signing tool provides a faster method to sign requests in bulk

Robust access control systems can be integrated with LDAP and customizable workflows to mitigate risks associated with granting wrong access to unauthorized users, allowing them to sign code with malicious certificates

Support for customized workflows of an “M of N” quorum with multi-tier support of approvers

Support for InfosSec policies to improve adoption of the solution and enable different business teams to have their own workflow for Code Signing

Validation of code against UpToDate antivirus definitions for virus and malware before digitally signing it will mitigate risks associated with signing malicious code