Code signing policy
Status: releases are unsigned for now. SignPath Foundation asked KeaClip to reapply once the project is better known, and it will; this page says so as soon as that changes. Every release lists its SHA-256 checksums in SHA256SUMS.txt either way.
Free code signing provided by SignPath.io, certificate by SignPath Foundation.
What gets signed
The Windows installer (KeaClip-<version>-Setup.exe) and the KeaClip program files in each release on the releases page. Only files built from this project's own source are signed. The free helper tools KeaClip downloads on first start (yt-dlp, FFmpeg, Deno) are signed or published by their own makers, not by this project.
How releases are built
Every signed release is built by GitHub Actions from the public source code in github.com/Langkurst/KeaClip, using the build scripts in that repository. Each signing request is approved by hand.
Team roles
All team members use multi-factor authentication for GitHub and SignPath.
Privacy
KeaClip has no tracking or analytics, and your files never leave your PC unless you share them. The things it does online by itself (fetching its helper tools once, and a daily update check you can turn off) are listed in its privacy section.
Contact
Questions or a security concern: keaclip@proton.me.