Code Signing Evidence Log (Criterion 3)

Checked: 2026-07-21, Windows 10 Pro.
Method: `Get-AuthenticodeSignature <file>` (PowerShell 5.1) for signature status, signer
certificate, and timestamp countersignature; `Get-FileHash -Algorithm SHA256` for integrity.
Reproducible by anyone: `Get-AuthenticodeSignature .\installer.exe | Format-List Status, SignerCertificate, TimeStamperCertificate`

Score: 6 of 16 installers signed (all 6 timestamped), 10 of 15 completely unsigned.

Note on the three Microsoft-issued certs (Howl, Osmium, Root): these are Azure Trusted
Signing certificates, which are deliberately short-lived. All three have ALREADY EXPIRED
(June/July 2026) but the signatures remain valid because they were timestamped. This is
the live demonstration of why "signed but not timestamped" would be worthless: without the
timestamp these binaries would fail validation within days of release.

---

SIGNED (valid signature + timestamp)

Element Setup.exe
- Signer: ELEMENT CREATIONS LIMITED, London, GB (UK company no. 10873661)
- Issuer: SSL.com EV Code Signing Intermediate CA RSA R3
- Cert expiry: 2027-06-24. Timestamp: DigiCert
- SHA-256: 084A496A8D7ACFBC667A8FD316B02201474C9AFF28BAB3EFCB0C1A97E8F4BFFE

gamevox-launcher.exe
- Signer: GameVox LLC, Ohio, US
- Issuer: Sectigo Public Code Signing CA EV R36
- Cert expiry: 2027-03-07. Timestamp: DigiCert
- SHA-256: 57B7A702DAE5C5CAA7DFBA282034B3339552BDB8260ED0406202E9C82E327585

hollow-0.8.1-win64-setup.exe
- Signer: Open Source Developer Vitalii Rovinskyi, UA (Certum Open Source Developer cert.)
- Issuer: Certum Code Signing 2021 CA (Asseco Data Systems S.A., PL)
- Cert expiry: 2027-06-16. Timestamp: Certum Timestamp 2026
- SHA-256: 5E7C9DA2800CF2B8A56E722CA1B0BFF2CBB9B8038F4F232ACA413B2BC4CACD90

Howl-Setup.exe
- Signer: Howl LLC, Sheridan, Wyoming, US
- Issuer: Microsoft ID Verified CS EOC CA 04 (Azure Trusted Signing)
- Cert expiry: 2026-06-30 (expired, so the signature survives via timestamp)
- Timestamp: Microsoft Public RSA Time Stamping Authority
- SHA-256: D183581F676A1A49940732C44BED4F92DD01EAF2DEFA69D06D582D3E8ED50BA1

Osmium-installer.exe
- Signer: Uncollapse, Albuquerque, New Mexico, US
- Issuer: Microsoft ID Verified CS AOC CA 04 (Azure Trusted Signing)
- Cert expiry: 2026-07-22 (expires one day after this check)
- Timestamp: Microsoft Public RSA Time Stamping Authority
- SHA-256: 009264224C405425FE09C7A5E01DE1EBD9A7068765B96DCDC10F39EDC1D11BCE

Root-win-Setup.exe
- Signer: Root Communications, Inc., West Hollywood, California, US
- Issuer: Microsoft ID Verified CS AOC CA 04 (Azure Trusted Signing)
- Cert expiry: 2026-07-19 (expired, so the signature survives via timestamp)
- Timestamp: Microsoft Public RSA Time Stamping Authority
- SHA-256: C2A99E8E78F46FCC2B2280748121A35A5810861FEB654CC5BB03177F4C4FC853

---

NOT SIGNED (no digital signature at all)

| File | Downloaded | SHA-256 |
|---|---|---|
| chatto.exe | 2026-07-19 | AF69DE0C4ED685DCD59112592960CBDC44A1921E976B69FBBF8071F392FB95F5 |
| commet-installer.exe | 2026-07-21 | BB785127916D4138D1D7D3D681DBCE084B7C4492C119D2053AD246D00B0D58F3 |
| DCTS Chat Setup 1.0.3.exe | 2026-07-11 | B4C73A8388A262443E83D176356210A5868A809BF1FF8759F94687F2F27343F2 |
| fluxer-stable-0.0.8-x64.exe | 2026-07-21 | 458107B8FC0C13FEB26166680CF2B9BC80C8198A8759598287B0A244142E6A54 |
| sharkord-windows-x64.exe | 2026-07-21 | 90BA7174D8F570D8A614380D6218A36E85B627CCE5461FA4FD37D670B74AE5B9 |
| stoat-desktop-setup.exe | 2026-07-21 | C05B252B9E35C74F1B03FD6831266182C068F3948724F69E72B502C1289CF5FD |
| Weered_0.1.7_x64-setup.exe | 2026-07-21 | 8F4F272570E60C68CD08B895DFB4ED0896AA430CA713A90FBC26901BECBBD931 |
| Nerimity-Setup-2.2.0.exe | 2026-07-21 | 765B87B079704DA4C01175BB847C1B688D7EE622B9A31D970D479E0FB59B36D3 |
| Spacebar_0.1.2_x64-setup.exe (official client, last release Feb 2024) | 2026-07-21 | F4DCBBAC20AE402EDED39AAA4FA6191FA8CE5A8E94288C4FA00EB8DCBA606A4D |
| Armada-v0.30.1-Setup.exe | 2026-07-21 | 41D225BE83F8AFF46DE7BE10AF3E825E25A82CD4CF63C920E6D65959B2803DE5 |

---

Not checkable (no Windows desktop installer exists)

- Matrix. Protocol, not an app (Element is its flagship client, checked above)
- Yapper. Web only during the check

Web-only is itself a criterion-3 finding: there is no installable artifact to sign or
verify. Trust rests entirely on the web origin at load time.