Keyless signing is a signing model that uses short-lived identity assertions instead of storing long-lived private keys in CI or build systems. It reduces persistent secret exposure and shifts trust to ephemeral certificates bound to the build actor at signing time.
Expanded Definition
Keyless signing is a signing model for software supply chains in which a build or release system proves its identity at signing time, then receives a short-lived signing credential instead of relying on a long-lived private key stored in CI infrastructure. That distinction matters in NHI security: the protected asset is not only the artifact signature, but the ephemeral identity assertion that authorizes signing. In practice, keyless signing is usually paired with workload identity, short token lifetimes, and policy checks that bind the signer to a specific pipeline, repository, or build event. The model aligns closely with NIST SP 800-53 Rev 5 Security and Privacy Controls when organizations want stronger provenance and tighter credential handling.
Definitions vary across vendors on how much trust is delegated to the signing broker, but the core idea is consistent: remove durable private keys from the most exposed automation layers and replace them with ephemeral authorization. The most common misapplication is treating keyless signing as a complete supply-chain security program, which occurs when teams adopt ephemeral certificates but leave build permissions, attestations, and artifact promotion controls ungoverned.
Examples and Use Cases
Implementing keyless signing rigorously often introduces tighter pipeline coupling and more validation steps, requiring organisations to weigh reduced secret exposure against added operational complexity.
- A CI pipeline authenticates with a federated workload identity, then receives a short-lived certificate only after the build passes policy checks.
- A release job signs container images without storing a private key in the runner, limiting exposure if the runner is compromised.
- A developer team uses keyless signing for provenance on artifacts, then verifies the signature before deployment into production clusters.
- A security team correlates signing events with build logs to prove which automated actor produced a release, supporting audit and incident response.
- An organisation replaces ad hoc key distribution in automation with ephemeral credentials, following the governance patterns discussed in the Ultimate Guide to NHIs and identity-bound controls described in NIST SP 800-53 Rev 5 Security and Privacy Controls.
Because the signing authority is issued dynamically, teams must also define who can request it, under what conditions, and how revocation or build failure affects trust in the resulting artifact.
Why It Matters in NHI Security
Keyless signing matters because persistent signing keys are exactly the kind of long-lived secret that creates unnecessary NHI exposure. NHIMG notes that 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, which is the environment keyless signing is meant to reduce. By shifting from stored keys to ephemeral assertions, practitioners reduce the blast radius of runner compromise, limit lateral movement from build systems, and make artifact provenance easier to audit. The model also supports broader Zero Trust goals because identity is evaluated at the moment of action rather than assumed from possession of a static credential. For organisations mapping this to governance, the NHI lifecycle and access review themes in the Ultimate Guide to NHIs are especially relevant.
Organisations typically encounter signature tampering, unauthorized releases, or secret theft only after a pipeline compromise, at which point keyless signing becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and CSA MAESTRO address the attack and risk surface, while NIST CSF 2.0, NIST Zero Trust (SP 800-207) and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-02 | Keyless signing reduces persistent secret exposure in CI and build identities. |
| NIST CSF 2.0 | PR.AA-01 | Identity proofing and authorization for workloads supports controlled signing actions. |
| NIST Zero Trust (SP 800-207) | 3.1 | Zero Trust evaluates the build actor at request time instead of trusting static keys. |
| NIST SP 800-63 | AAL2 | Short-lived assertions should provide assurance comparable to the action being authorized. |
| CSA MAESTRO | Agentic automation needs scoped, ephemeral authority for privileged actions like signing. |
Remove long-lived signing keys from automation and require ephemeral identity-bound authorization.
