I'm trying to figure out how to establish trust in Windows executables that I download from the internet.
Some software that I download, such as KeepassXC, has a Windows Digital Signature, but they also provide a PGP signature that I can manually verify using a certificate that I get from their code repository.
Other software that I download, such as my tax software, is also signed with a Windows signature but they don't provide a PGP signature that I can verify.
- Does a Windows Digital Signature and a PGP signature perform the same function?
- Is one or the other enough to trust that the executable hasn't been tampered with by a third-party? If so, why does some software provide the additional PGP signature and tell me that I need to validate it, if that software is already signed?