Instead of OpenPubkey
OpenPubkey alternatives
OpenPubkey connects user and workload identities to public keys through OpenID Connect. Its PK Tokens prove control of an identity and its private key at a specific time when a verifier trusts the identity provider. Users can sign messages and artifacts through API, self-hosted, Linux, macOS, and Windows options. It supports user and workload identities, works with several providers without provider changes, and adds replay protection through GQ signatures. The project is free, open source under Apache 2.0, and does not require an added certificate authority.
- 1
AWS Signer
Free plan APILinuxMac+2Managed AWS code, Lambda, IoT, and container signing — AWS Signer manages certificates and keys for Lambda, IoT, and container signing, unlike OpenPubkey’s identity-bound PK Tokens.
7.7 Visit site - 2
Cosign
Free plan LinuxMacSelf-hosted+1OCI containers and software artifacts across registries — Cosign uses Fulcio certificates and Rekor’s transparency log for keyless signing, while OpenPubkey issues identity-bound PK Tokens.
- 3
SignPath
Free plan APILinuxMac+3Policy-controlled signing across software build pipelines — SignPath verifies repositories, branches, builds, approvals, and CI/CD context, adding policy and attestation controls beyond OpenPubkey.
- 4
SignServer
Free plan APILinuxMac+3Centralized multi-purpose signing installations — SignServer centrally stores signing keys and signs code, containers, firmware, documents, and timestamps rather than binding identities to keys.
- 5
Notation
Free plan LinuxMacWindowsPortable OCI registry signing from the command line — Notation implements Notary Project specifications for portable OCI signatures that work across connected and disconnected registries.
- 6
Sigstore
Free plan Open source APILinuxMac+3Open-source supply-chain signing with public transparency — Sigstore combines ephemeral keys, Fulcio certificates, Rekor’s searchable log, and Cosign for broad software supply-chain coverage.
- 7
SignPath Foundation
Free plan APIWebEligible open-source projects seeking signing certificates — SignPath Foundation links approved open-source releases to repositories through certificates, verified builds, and manual approval instead of PK Tokens.
- 8
Bamboo Deploy
Free plan APILinuxMac+2 - 9
Signo
Free plan APILinuxSelf-hosted - 10
Aujas Automated Code Signing Platform
Paid LinuxMacSelf-hosted+2 - 11
Gitsign
Free plan LinuxMacWindows - 12
Keyfactor Platform
Free trial APISelf-hostedWeb - 13
LAAVAT PKI and Signing Platform
Free trial APISelf-hostedWeb - 14
The Update Framework
Free plan - 15
DigiCert Software Trust Manager
Paid APILinuxMac+2 - 16
Signotaur
Free trial Self-hostedWindows - 17
ComSignTrust Secure Code Signing Platform (ASCS)
Paid APIWeb - 18
CyberArk Code Sign Manager - Self-Hosted
Paid APILinuxMac+3 - 19
GoGetSSL Cloud Code Signing
Paid MacWebWindows - 20
Red Hat Trusted Artifact Signer
Paid LinuxMacSelf-hosted+2 - 21
Code Signing Key Management Server (CSKMS)
Paid APISelf-hosted - 22
GaraTrust
Paid Self-hosted - 23
PACE Code Signing Platform
Paid LinuxMacWindows - 24
sslTrus Remote Code Signing Service
Paid LinuxMacWeb+1
Alternatives become relevant when you need a different signing scope or operating model. OpenPubkey’s client and verifier currently create and verify tokens from Google for users and GitHub for workloads, despite broader stated compatibility. Public PK Tokens can expose ID-token claims such as names or email addresses. Workload scenarios require GQ signatures, and identity-held key pairs are expected to be ephemeral. Compare artifact types, key custody, approvals, build controls, registry support, deployment, and price before switching.