Code Signing Certificates are not enough
medium.com