Digital Signature verification process for software installation can be done automatically during execution or manually by user. (I'm considering PKI Method of certification.)
For example, in case of some exe's on Windows OS, if the Digital Signature verification fails, the binary fails to execute because of automated Digital Signature verification. Whereas, some .exe's do not verify signatures automatically, and user can verify the Digital Signature manually. Also, in case of detached signatures such as catalog file or CMS signatures verification can be done by user manually with available commands such as Get-AuthenticodeSignature or OpenSSL respectively.
So, regarding manual vs automated methods I had a discussion with someone, and he told me that manual verification is a flawed process since user may forget to verify the signature. So, automated verification is a necessity.
On the other hand, I think manual verification is better even if user forgot since in automated verification there is more possibility of user being careless and trust the automated process which can be exploited if system or keys are compromised.
Also, I think that both the methods are secure until the Signing Key is secure, and System Integrity is maintained where verification needs to be done.
So, my question is there any added advantage to Automated Digital Signature verification in the case of software installation where user interaction is involved.
Edit: Please consider below scenarios for the same
- Systems are not connected to internet so no automated updates.
- Installations are done manually or atleast intiated manually by user.