Anything that requires an old school code signing certificate is DOA IMO. A website, GitHub account, MS account, etc. are better indicators of trustworthiness

Anything that requires an old school code signing certificate is DOA IMO. A website, GitHub account, MS account, etc. are better indicators of trustworthiness than some LLC. EV code signing certificates are a money grab and anyone willing to spend a few dollars on an LLC + certificate can distribute all the adware / malware they want. We need a trust / verification system that's built for more than grabbing money out of the pockets of developers.