Which is why automated signatures in release pipelines are usually meaningless. Authors must sign their code on their own hardware before it is published so we

Which is why automated signatures in release pipelines are usually meaningless. Authors must sign their code on their own hardware before it is published so we can tell when the signing key changes and pay extra special attention to that, and maybe a longer delay.