EV Code Signing: USB Token vs Cloud HSM — The Hidden Costs
Starting June 2023, all code signing certificates must store private keys on hardware. CAs now aggressively push cloud HSM services. Here's what they don't tell you about the real costs.
The Cloud HSM Trap
DigiCert, Sectigo, and GlobalSign offer "cloud signing" services:
- DigiCert KeyLocker — $359/year + limited signatures
- SSL.com eSigner — $240/year base + $0.25–$2.00 per signature
- Azure Trusted Signing — $9.99/month + per-signature pricing
For a company signing 50 builds/day:
| Service | Annual Base | Per-Sign | 50 signs/day | Total/Year |
|---|---|---|---|---|
| SSL.com eSigner | $240 | $0.50 | $25/day | $9,365 |
| DigiCert KeyLocker | $359 | Included | Throttled | $500+ |
| Azure Trusted Signing | $120 | $0.005 | $0.25/day | $211 |
| OneSigner + USB Token | $99 one-time | $0 | $0 | $99 total |
The Internet Dependency Problem
Cloud HSM requires internet for every signature. Your CI/CD pipeline depends on third-party API uptime. When DigiCert had a 4-hour outage in 2024, thousands of builds failed worldwide.
With USB token + OneSigner: signing is local, no internet needed, no rate limits, no per-signature costs.
Latency: Local vs Cloud
Cloud HSM adds 200–800ms network latency per signature. OneSigner signs locally in ~4 seconds including full PDF processing. For batch operations, cloud latency compounds significantly.
The "Convenience" Tax
CAs market cloud signing as "convenient." But you still need API integration, OAuth tokens, and you now have vendor lock-in. A USB token on your build server is actually simpler.
Token Setup: One-Time 30 Minutes
- Buy SafeNet eToken or YubiKey (~$50–80)
- Install driver (5 minutes)
- CA provisions certificate (automated)
- Configure OneSigner with serial + PIN (5 minutes)
- Done. Sign unlimited files forever.
When Cloud HSM Makes Sense
Cloud HSM is appropriate for: distributed teams across continents, millions of signatures per month, FIPS 140-2 Level 3 compliance, or no physical server available. For the other 95% of companies? $99 + USB token wins.