# Windows Signing Model (Skeleton)

Status: skeleton

## Current guarantees
- Package-level Ed25519 verification is preserved as the canonical trust-chain model.
- Windows metadata must continue to publish `signature_algorithm: ed25519` and a detached `.sig` file reference.

## Future extension (not implemented in this phase)
- Authenticode support may be added as an additional Windows-native signature layer.
- Authenticode must be additive and must not replace Ed25519 release verification.

## Explicit non-goals in this phase
- No certificate enrollment.
- No signtool integration.
- No timestamping service integration.
