---
title: "Signing is for the bad days"
url: https://daily.dev/posts/signing-is-for-the-bad-days-x6tdcvkg1
source_url: https://nesbitt.io/2026/05/24/signing-is-for-the-bad-days.html
type: article
source: "Andrew Nesbitt"
published: 2026-05-24T10:47:19.606Z
updated: 2026-05-24T10:47:46.948Z
tags: ["security"]
reading_time: 13
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Signing is for the bad days

**[Andrew Nesbitt](https://daily.dev/sources/nesbitt-io)** · 13 min read · 0 upvotes · 0 comments

## Summary

A deep dive into why software supply chain signing tools (TUF, in-toto, and Sigstore) appear useless on normal days but become critical during security incidents. TUF protects the last hop from registry to client by splitting signing roles with offline keys, preventing rollback and freeze attacks even when a registry is compromised. in-toto attests the entire build pipeline by recording signed links at each step, which would have caught the xz backdoor and SolarWinds-style build server compromises. Sigstore eliminates long-lived key management by using short-lived OIDC-bound certificates and a public append-only transparency log (Rekor), making forensic investigation fast and tamper-evident. The post also honestly acknowledges limits: recent attacks like Ultralytics and TanStack compromised the CI runner itself, bypassing these controls — but the transparency log still accelerated incident response. The three layers compose: in-toto defines valid builds, Sigstore handles keyless signing, and TUF secures distribution. npm provenance, PyPI attestations, and SLSA are all manifestations of this stack.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://nesbitt.io/2026/05/24/signing-is-for-the-bad-days.html>

## Similar posts on daily.dev

- [in-toto](https://daily.dev/posts/in-toto-myn2yl8xa) · Hacker News · 1 upvotes · 0 comments
- [gittuf - a signed log for git refs](https://daily.dev/posts/gittuf---a-signed-log-for-git-refs-bfl72wcmm) · Andrew Nesbitt · 2 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security)

[View this post on daily.dev](https://daily.dev/posts/signing-is-for-the-bad-days-x6tdcvkg1)