Sign every artifact with HSM-protected keys.

Signing operations happen inside the HSM — the build agent never sees the private key. Your pipeline authenticates to TigerTrust with a short-lived OIDC token (GitHub Actions, GitLab CI, Azure DevOps all supported) or a workload identity, sends the artifact hash, and receives a signature. Even a fully compromised build host cannot exfiltrate the key. Per-key policies let you require multi-party approval, restrict signing to specific branches, or gate production signing to time windows.

Yes. TigerTrust runs a Sigstore-compatible signing service that issues short-lived certificates tied to workload identity (OIDC), plus a Rekor-compatible transparency log for your artifacts. You can also use TigerTrust as the Fulcio-equivalent CA for a fully self-hosted Sigstore stack. Cosign works out of the box with either keyed (HSM-backed) or keyless (OIDC-bound) modes.

Rotate to a new signing key on any policy interval (annually, on team change, on incident). Because every signature includes an RFC 3161 timestamp and TigerTrust preserves the signing certificate for the entire artifact retention window, previously-signed artifacts remain verifiable indefinitely — even after the signing certificate expires or the key is retired. Long-term validation (LTV) metadata is embedded automatically.

Median signing latency is under 2 seconds for typical artifact hashes; batch endpoints amortise HSM round-trips for CI jobs signing hundreds of artifacts at once. Real-world throughput per HSM cluster is around 5,000 signatures per second sustained. If your pipeline pushes millions of container images per day, HSM partitions scale horizontally with per-team isolation.

Yes. Microsoft Authenticode signing meets the CA/B Forum requirement for FIPS 140-2 Level 2+ hardware key storage (we exceed with Level 3). EV code signing certificates are supported with the required hardware enforcement. Apple Developer ID signing and notarization work with keys stored in TigerTrust HSMs via Apple's notarization API. All standards updates (e.g. CA/B Forum 2024 EV requirements) are tracked and applied without you having to change your pipeline.