>In Windows world, you can just pick a new certificate vendor
I mean if they really wanted to they could blacklist your CN or O value in the certificate, or add you to the windows defender/smartscreen detection list, which will effectively kill your app for a good segment of the windows userbase.
I’m not aware of that ever happening though - and the workaround is just to get another certificate from another CA vendor.
I have code-signing certificates myself: the verification process did not fill me with confidence that the system is trustworthy - GlobalSign had me email them details of my DUNS/ UBI / business registration and a notarised copy of my driving license and checked that my name matched, and that was it. I could easily fraudulently obtain a code-signing certificate with a fake ID matching the name and state of some other vendor I just took a disliking to.
(I recognise that this system’s adding of barriers-to-entry does eliminate large numbers of opportunistic malware and provide a means to quickly disable installation and execution of revoked certificates - so I’m not calling for the system to be torn down!).
Having to pay money introduces a money-trail and a paper-trail. If a payment for a certificate is made with stolen CC details then the certificate gets revoked. This also effectively stops opportunistically-written malware taking advantage of current events (click bait email subject lines) to spread via email attachments.
The value from code-signing isn’t just the (I agree: very weak) attestation of the software’s author’s identity - but because it introduces a revocation mechanism and a reputation system - and creates barriers-to-entry that burden malware authors more than legitimate software vendors.
It’s not perfect, but don’t let perfect be the enemy of good.
Also remember that the only proven successful alternative to the current open PKI/CA system is the closed walled-garden approach favoured by Apple. I don’t think any Web-of-trust system has ever really been demonstrated as being feasible long-term without some WoT nodes evolving into pre-trusted/super-trusted nodes with the same power that CAs have today.
And at least with PKI+CAs you can add your own trusted root certificates and remove those you don’t trust.
I mean if they really wanted to they could blacklist your CN or O value in the certificate, or add you to the windows defender/smartscreen detection list, which will effectively kill your app for a good segment of the windows userbase.