Keyfactor Signum
Overview
Keyfactor Signum is a cloud code signing service that moves signing keys off developer workstations and into HSM-backed cloud infrastructure, with central policy and audit. Unsung, a Keyfactor Silver Partner, supplies and implements Signum for UK organisations that want governed code signing without running signing infrastructure themselves.
Buying Keyfactor Signum through Unsung
We advise independently on the right licensing model and product mix for your organisation, so your investment delivers value for money from Keyfactor.
We also provide partner pricing through our Keyfactor partnership, and integration with your existing toolchain, from SignTool, Jarsigner and Cosign to Jenkins and your wider CI/CD pipelines. If something goes wrong, our PKI consultants provide first-line triage and escalate to Keyfactor when needed.
The Challenge
Many organisations still keep code signing keys on individual developer machines or shared drives. If those keys are lost or stolen, they can be used to sign malicious software that appears legitimate, and there is often no central record of who signed what, or when.
Development teams also resist signing steps that sit outside their CI/CD pipelines. Organisations need keys held in HSMs, clear policy on who can sign, signing built into existing workflows and audit evidence for compliance teams, ideally without having to build and operate on-premises signing infrastructure.
What It Does
Signum provides cloud-hosted code signing with keys generated and held in cloud HSMs, so they never leave the hardware boundary. Policy controls set which users, teams and pipelines may sign which artefact types.
Developers sign using familiar tools, including SignTool, Jarsigner, Cosign, OpenSSL and Jenkins, while Signum handles the HSM interaction behind the scenes. Every signing operation is logged with the signer, the artefact, and the key and certificate used, giving security and compliance teams the evidence they need.
How Unsung Helps
We help clients design code signing policies, integrate Signum into development pipelines and put in place the governance needed for auditable signing. Our consultants also advise on how cloud signing fits your wider PKI and security architecture.
Signum is a good fit when cloud hosting is acceptable. Where keys and signing must stay on-premises, for example in classified or air-gapped environments, Enterprise Code Signing or SignServer Enterprise are likely to suit better. We supply all three, so our advice follows your requirements rather than a single product.
Related Unsung Services
- PKI Consultancy: advice on code signing strategy and software supply chain security.
- PKI Design & Build: design and implementation of signing infrastructure and CI/CD integration.
- Certificate Lifecycle Management: management of the code signing certificates behind your signing keys.
