签名是为坏日子准备的
TUF、in-toto 和 Sigstore 在风平浪静时看似多余，唯有当系统起火时才显其价值——安全签名的意义，恰恰体现在糟糕的日子里。
相关报道
The article discusses how code signing should be integrated into development workflows early, not just as a last-minute step before release. It emphasizes that signing is most valuable during debugging and testing on "bad days"—when things break—because it helps maintain security and traceability throughout the development process.