[fermentation]

Except this requires you to own a business for 3+ years, which makes it a non-starter for indie apps.

[delta_p_delta_x]

Not anymore: Artifact Signing is now generally available (GA), to anyone with an Azure account in the US, Europe, or the UK[1].

[1]: https://techcommunity.microsoft.com/blog/microsoft-security-...