Formats are platform-specific: Authenticode for Windows PE files, MSI and PowerShell; Apple code signatures with Developer ID certificates plus notarization; APK Signature Schemes for Android; JAR signing for Java; RPM and Debian repository signatures with OpenPGP; container image signatures with cosign; UEFI Secure Boot with its own key hierarchy. Timestamps let signatures outlive the certificates that made them.
Publicly trusted code-signing certificates follow the CA/Browser Forum Code Signing Baseline Requirements: since 1 June 2023 the private key must be generated and kept in a hardware module (FIPS 140-2 Level 2 or Common Criteria EAL 4+ minimum), and from 1 March 2026 the maximum certificate validity is 460 days (ballot CSC-31).
Stolen signing keys are a recurring attack route (Stuxnet's driver certificates, the 2012 Adobe build server compromise), so hardware-held keys, separate signing services and revocation plans matter more than the algorithm choice.