[jrockway]

Wouldn't people just get socially engineered into giving up their code signing certificate? Some ads along the lines of "give us your code signing certificate and be entered into a raffle for an iPhone" would probably work. Stand in line to get some document you'll never use, maybe win a gadget, and a few days later your name is being used to spread malware.

Basically, I don't think a natural person is enough protection against malice. Something like "stick 1 million dollars into escrow, and if someone uses your cert to spread malware, we keep it" is a much stronger incentive. (Not what's done, of course.)

[celticninja]

You need to cater for those people, they will be the bulk of your clients and also need the most support. So make resetting it possible but not easy.