title: Should I sign bundle and/or all MSI files? WIX
body: <p>I use WIX toolset to generate MSI files and then put them in a single bundle.
  Then, I sign<a href="http://wixtoolset.org/documentation/manual/v3/overview/insignia.html" rel="nofollow noreferrer">(wix manual)</a> the engine from the bundle and the bundle itself:</p>
  
  <pre><code>insignia -ib bundle.exe -o engine.exe
  signtool sign /v /f test_cert.pfx /p pass1234 /t http://timestamp.globalsign.com/scripts/timstamp.dll engine.exe
  insignia -ab engine.exe bundle.exe -o bundle.exe
  signtool sign /v /f test_cert.pfx /p pass1234 /t http://timestamp.globalsign.com/scripts/timstamp.dll bundle.exe
  </code></pre>
  
  <p>I saw some posts describing the process and they included signing all MSI and cabs files as well. I wonder whether it is enough to sign the engine and the bundle and not MSI files. What are the consequences? What is the recommended way?</p>