title: Who should own the private key used to sign a .NET assembly when its project is open-source?
body: <p>More specifically, a class library assembly. My initial thoughts:</p>
  
  <ul>
  <li>Have some designated administrators do all the assembly signing. But then when bug fixes and new versions are written, the binaries would ultimately depend on them being around (even if its just a small change for private reasons).</li>
  <li>The key could be publicly available. But that goes against public-key cryptography practices and you lose the advantage of trust and identity.</li>
  <li>Allow end-developers and distributors to sign it with their own keys. But then you lose modularization since each new signing makes it incompatible with some of the other versions.</li>
  </ul>
  
  <p>Sure, you could just not sign the assembly. But if another project that requires their assembly to be signed references your library, you get a compile error.</p>