Since June 2023 you cannot buy a code-signing certificate as a file any more. The CA/Browser Forum baseline requirements for code signing oblige the private key of an OV or EV certificate to be generated and kept in a certified hardware cryptographic module — so every commercial CA now issues onto a token, an HSM, or its own cloud signing service.
That leaves you three options: sign in someone else’s cloud, buy a network HSM, or hold the key yourself in something the size of a USB stick. The KeyNub HSM is the third one.
One key, one copy, and it cannot be exfiltrated
The signing key is generated inside the smart card fitted in the device and is non-extractable. There is no export command and no firmware path to it, so a build machine that is compromised can be made to sign while the attacker holds it — but cannot walk away with the key and sign forever afterwards. That distinction is the entire point: a leaked code-signing key means revoking every release you ever shipped, and revocation is retroactive.
It also removes the copy you did not mean to make. A PFX on a build server is on the backup, in the image, and in whatever the last developer copied to their laptop to fix a release at midnight.
It signs with the tools you already use
The device presents the standard smart-card reader class, so the key is reachable through PKCS#11 and through the Windows certificate store. In practice that means signtool and osslsigncode for Windows binaries, jarsigner for Java, osslsigncode or sbsign elsewhere, and gpg or cosign for artefacts that use their own formats. Nothing needs a KeyNub library: see the Windows certificate store and Java keystores for the two setups people ask about most.
Timestamp your signatures. A timestamped signature stays valid after the certificate expires, which is what lets a binary you shipped three years ago keep verifying without re-signing it.
A certified platform, and an attestation of it
Signing keys are generated on a Common Criteria EAL6+ certified smart card platform. The device also produces a signed attestation of its firmware version, its configuration and the identity of the card fitted in it, so the hardware origin of a key can be demonstrated and not merely asserted.
A USB device suits a workstation or a dedicated signing host somebody can reach. A pipeline that signs on ephemeral cloud runners with nobody present needs a different shape of hardware.
Where to go next
Code signing is the use case with a deadline attached, because the rule already applies. See also running your own CA, document signing, or the hardware security module overview and the datasheet.
The KeyNub HSM ships from Munich. Ask us if you want to talk through a deployment first, or order one.
