Code signing
Sign executables with a private key so the OS can verify origin + integrity before execution. Windows Authenticode, Apple Notarization, Android APK signing, Linux RPM signing.
EV Code Signing cert: expensive (~400 USD/year), requires a hardware token (can't be exported), gives Windows SmartScreen instant reputation. OV cert (regular): builds reputation over time. Apple: notarization automatic via Xcode + altool, Gatekeeper blocks non-notarized apps. Sigstore Cosign: keyless code signing with OIDC + Fulcio cert + Rekor log → no private key to protect. Classic attack: stolen signing key used to sign malware (Stuxnet had stolen Realtek and JMicron certs).