An Industry Interview Study of Software Signing for Supply Chain Security

Kelechi G. Kalu, Tanmay Singla, Chinenye Okafor, Santiago Torres-Arias, James C. Davis

34th USENIX Security Symposium · Day 1

This article delves into the findings of "An Industry Interview Study of Software Signing for Supply Chain Security," a qualitative research paper presented at USENIX Security. The study addresses a critical gap in understanding why **software signing**, despite being widely recommended by cybersecurity frameworks and regulations, sees low adoption and inconsistent implementation in industry. While prior quantitative studies have highlighted the prevalence of missing or erroneous signatures, a deep, qualitative understanding of industry practitioners' experiences, challenges, and rationales has been lacking.

AI review

Solid qualitative research that finally answers 'why' instead of just 'how bad' on software signing adoption. The refined SSCFM model and the 'unidirectional trust' finding are genuinely useful contributions. Not groundbreaking methodologically, but fills a real gap in the literature with practitioner-grounded data.