@Thanh-Hai Tran @Alex Gleason
The $10/mo is **Azure Artifact Signing** (formerly Trusted Signing) — a Microsoft-operated signing service, not a traditional CA certificate. The ID scan and face verification are **Microsoft's own identity validation** for issuing the signing certificate through that service. It's not a CA requirement; it's Microsoft's internal process for vouching that the entity requesting the certificate is who they claim to be.
Key distinctions:
| | Azure Artifact Signing | Traditional OV/EV CA (DigiCert, Sectigo, etc.) |
|---|---|---|
| Cost | ~$9.99/mo | $150–400+/yr |
| Identity validation | Microsoft verifies (govt ID, face scan, business days) | CA verifies (DUNS, registration docs, sometimes in-person) |
| Key storage | Cloud HSM, no USB token | HSM or USB hardware token required (CA/B Forum rule since 2023) |
| SmartScreen | Reputation builds over time; initial warnings expected | Same — reputation builds over time |
| Availability | Orgs: US, CA, EU, UK, AU, NZ, JP, KR, SG, CH, NO, IL. Individuals: US, CA only | Worldwide |
So Alex's "humiliation ritual" is specifically Microsoft's identity validation for Azure Artifact Signing. The face scan and ID upload are how Microsoft confirms the legal entity before issuing the cert. [learn.microsoft.com](
https://learn.microsoft.com/en-us/windows/apps/package-and-deploy/code-signing-options)
**On Apple:** Yes, the same pattern exists, just with different flavor:
- **Developer ID** (for Mac/Windows distribution outside the App Store): You apply for a certificate from Apple, which requires your organization to be registered in the Apple Developer Program ($99/yr). Apple validates your identity — for organizations, this includes legal entity verification. No face scan, but there's a verification process involving D-U-N-S numbers, legal documents, and sometimes phone/video verification for new or flagged accounts.
- **App Store submission**: The app itself goes through Apple's review process (1-7 days typically, longer for complex apps), which is a different kind of "humiliation" — an opaque human review where Apple can reject for reasons that are sometimes maddeningly vague.
- **Notarization** (macOS): After signing with Developer ID, you submit the app to Apple for notarization. This is automated but adds another step and another potential failure point.
So the pattern is: **every major platform requires identity verification before they'll let you sign code that their OS will trust.** The specific mechanics differ (Microsoft: face scan + ID upload; Apple: DUNS + legal docs + sometimes video verification; traditional CAs: in-person or document-based KYC), but the underlying logic is the same — the platform is taking on reputational risk by trusting your signature, so they need to know who you are.
The frustration is legitimate. The "unsafe" warning (SmartScreen) is a product Microsoft designed, and the only way to suppress it for non-Store distribution is to go through their identity validation pipeline. There's no "just trust me" path. The same is true on Apple — unsigned or unnotarized macOS apps get Gatekeeper warnings. The platforms created the friction, then made the only resolution path go through their own verification gauntlet.
