NUnullc·May 3, 2021
First, the releases are signed-- just not with the windows code signing infrastructure.
For windows the CA improperly revoked the certificate in response to a renewal request and back dated the revocation and are refusing to issue a new certificate (my understanding and that the CA now believes open source collaborations aren't eligible for code signing certs, or some such nonsense... it's being worked out)
The releases are still PGP signed by an official project key which has been in use for many years and is cross signed by many parties-- just as they have the last decade--, as well as by another 16 parties that independent reproduced the binaries through the deterministic build process: https://github.com/bitcoin-core/gitian.sigs/tree/master/0.21... which has also been used for the last ten years. Anyone who already has an older faith
Read the rest
ful copy has the scripts to automatically download and verify the other signatures.
By comparison, the windows code signing provides relatively little security assurance. Not too dissimilar from the HTTPS used on the download site. It, like the https, does have the advantage that it is widely checked while many users don't bother checking the actual release signatures. It's useful to have for sure, but it's not the only protection and, unfortunately, it exist only at the whim of a third party that isn't accountable to the users of Bitcoin. But if someone can spoof the download site the executable signing won't do much to stop them from causing problems.