"an HTTPS server automatically signs any file that it serves" is a perfect way to put it. When it comes to getting access to code signing certificates, in many

"an HTTPS server automatically signs any file that it serves" is a perfect way to put it. When it comes to getting access to code signing certificates, in many cases the state of the art is to have the signing certificate escrowed so aggressively that the only way to sign a binary is for it to go through a full build pipeline, because the central build servers are the only thing with access to the certificate. That significantly reduces the risk of someone managing to get your signing certificate and sign malware, which means you can focus on other vulnerabilities in your pipeline like your revision control server or your library dependencies.