Should I be worried that bitcoincore.org now suddenly only provides an "unsigned" Bitcoin Core installer? My security script for downloading and verifying new versions of Bitcoin Core barked at me the other day, when the new v0.21.1 was released. (Which still is nowhere to be found on bitcoin.org, BTW.)
At first, I thought it was a temporary glitch, but now it's been like this for at least three full days. The reason it &quot;barked&quot; is that my script is expecting ...win64-setup.exe, but that file no longer exists. Instead, it's called: ...win64-setup-unsigned.exe.
See for yourself: https://bitcoincore.org/bin/bitcoin-core-0.21.1/
So, they are no longer making &quot;signed&quot; installers? Beginning with Taproot? Hmm... Something about this feels scary to me. Maybe I'm too paranoid, but after all, you can't be too sure when it's about your entire &quot;wealth&quot;.
Isn't it something bad if the installer is no longer &quot;signed&quot;? Isn't that a step backwards security-wise, when a major update is being added to Bitcoin Core? Smells a bit fishy to me, frankly.
Beginning with Taproot? Hmm... Something about this feels scary to me.

Your mistrust is misguided.

So, they are no longer making &quot;signed&quot; installers?

The releases are still signed with the release GPG key, what is lacking is the Windows specific binary signatures which have to be made by a paid certificate by one of several authorities Microsoft has trusted. Bitcoin Core being an open source project is having issues getting a new one issued, this is called out specifically in the release notes.
The only thing this changes is that there will be a warning when the binary is first run, it is completely meaningless  to the actual security of the system as there are other stronger verification methods already in place.

Binaries in that folder are still built using Gitian and are still verifiable as being compiled from the source code if you so choose.
Gitian binaries are still signed by hoards of people who attest that they got the same result as everybody else.
Binaries are still signed by the same GPG release key as always.


Which still is nowhere to be found on bitcoin.org, BTW

See this issue on GitHub for discussion.