The current code signing paradigm was already tenuous but this change to DigiCert is going to cause far fewer packages to get signed as fewer devs acquire and r

The current code signing paradigm was already tenuous but this change to DigiCert is going to cause far fewer packages to get signed as fewer devs acquire and renew the now very costly certs. We need working alternatives. You didn't provide any solutions but decided to downvote anyway. Code signing has always been about validating the source of a binary and that it hasn't been modified from what the publisher intended. This is done by relying on a third-party validation mechanism. DNSSEC DANE TLSA meets both of those qualifications. So does GitHub. I'd be fine with either or both as options. Microsoft owns GitHub too, so code signing could be done through that medium. Public CAs in a trusted root store allow for offline validation but let's be realistic - most devices and software are online these days and public CAs aren't particularly worthy of anyone's trust. Domain-pinning a private CA in a trust store via TLSA (or GitHub, whichever) would allow for one-time online validation and then permanent offline validation for any given binary thereby allowing device drivers to still load offline. Microsoft unfortunately still claims that code signing stops malware. Time has effectively proven that to be false as code signing has stopped approximately zero malware infestations. Training personnel to be constantly vigilant through ongoing training modules has proven to be far more effective.