title: Signing Code (windows binaries) platform for systemhouse
body: <p>We are signing our code (windows binaries) with key signed by trusted CA. </p>
  
  <p>I don't like the idea that every developer has the crt+key and there is no control what has been signed. I also don't like the idea of CI (jenkins) that auto signs every binary. </p>
  
  <p>I'm looking for a centralized solution to sign code with auditing (so I will know what and by who has been signed). Perfect would be to have a way that requires ACK from at least two members of managers group.</p>
  
  <p>How that process is organized in your companies? What is the proper solution backed by best practices? </p>