So, that's plausible, and I'm trying to wrap my head around the operational model of signed software. Apple has plenty of docs about it [1] [2] [3] but never re

So, that's plausible, and I'm trying to wrap my head around the operational model of signed software. Apple has plenty of docs about it [1] [2] [3] but never really get into "how does this work in the long run when things fail" beyond blithely noting that users won't be able to run your stuff and a host of services will start to fail. A CRL / OSCP makes sense, more or less, for websites as they can simply abandon a cert. If the cert leaks, is the remedy really to completely blacklist the certificate? Because that means that anyone who is able to steal the cert can effectively blackmail an author. I'd definitely want to revoke it, but if there's a set of valid releases, it seems like you'd want to do a partial revocation, e.g. "valid until YYMMDD." Or have a blacklist / whitelist and mark known good releases. I can't imagine how they don't have a separation of concerns given that app certificates must expire. [1]: https://developer.apple.com/support/certificates/ https://developer.apple.com/support/certificates/ [2]: https://help.apple.com/developer-account/#/dev138c9fac7 https://help.apple.com/developer-account/#/dev138c9fac7 [3]: https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/AboutCS/AboutCS.html https://developer.apple.com/library/archive/documentation/Se...