Protect the private key.
The private key is the sensitive part of the signing identity. The provider’s approved storage and authentication method must fit your environment.
Cloud, token and HSM options.
A cloud service protects the key in a provider hosted environment. A USB token stores it on a physical device. An HSM provides dedicated hardware security infrastructure. Product support and access requirements vary.
Check automation before purchase.
Confirm whether the plan supports your signing client and build environment. Interactive approval, session duration and signing limits may affect automation.
Questions to ask.
- Which operating systems and tools are supported?
- Is interactive authorization required?
- What signing limits apply?
- How will access, renewal and recovery be managed?