I don't have a huge issue with the expense, but I don't think it should be a requirement. I think it should be more of an upgrade. For example, let me get a p

I don't have a huge issue with the expense, but I don't think it should be a requirement. I think it should be more of an upgrade. For example, let me get a personal code signing certificate for $50 per year and then treat an organizational cert as an upgrade where I pay $500 to have my business name on the cert. I could even see a case for having $5000+ high value certificates. The problem with that is the way companies like Microsoft handle them. Instead of telling the user "this is a low value cert", they put up a massive warning telling the user their computer is going to melt down if they trust it. It makes the decision of whether or not to run something binary and it's not. I think a system where I could sign things as trivial as PowerShell scripts would be better than what we have now. Anyone I give something like that to is going to know me personally and can easily judge the trustworthiness of what they're running by seeing my name. > This sort of "price people out of being annoying or doing things they don't remotely need" technique is extremely common in society. From what I see, it makes things difficult for someone trying to provide fair value and favors anyone willing to price gouge their customers. Even worse, criminal activity is extremely high margin and industrial scale bad actors have no problem paying for things like EV code signing certificates. > EV certs involve a pretty lengthy number of checks, by the way. Having a PO box isn't enough. And, based on my experience, it's all a big clown show. The people doing the verification are at a huge informational disadvantage because (I'm assuming) they're in a processing somewhere with minimal training and are expected to verify identities for every jurisdiction in the world. It's like me trying to verify the identity of someone in China. No matter how much training you give me, I'm probably never going to be as good at it as a local would be. The whole system could be better. I would prefer to see something where everything starts with a personal code signing certificate for a natural person and where getting an EV certificate requires an attestation from someone with a personal certificate. My identity is more valuable than a shell company. There's no incentive for anyone to fix it either. The platform owners benefit immensely if people abandon a standardized code signing system in favor of the signing certificates they issue for their app stores. IMO that's half the reason Microsoft abused their market position to kill AppGet. Anything that improves competition for app distribution isn't going to be allowed.