Since June 2023 every code signing private key must live on certified hardware. That leaves two compliant shapes: hardware you hold, or hardware the certificate authority holds. Both are legitimate; they fail in different ways.
The case for cloud
Nothing is shipped, so nothing is delayed at a border and nothing can be lost. A new developer joining the team does not have to wait for a courier. If the laptop dies, the certificate is unaffected — it was never on the laptop.
The case for a token
You physically control the device. Some organisations have an internal policy that requires this, and policy is a valid reason even when the security difference is marginal. A token also works with no network connection, which matters in air-gapped build environments.
The real decision point: how your releases get signed
This is where teams get surprised, so it is worth being blunt.
A hardware token cannot be used by a cloud build runner without physical USB passthrough, which is usually impossible. Cloud signing is reachable over the network, but each signing operation is authorised in the SimplySign app — there is no secret you can paste into a pipeline and forget.
Klarseal sells signing for releases a person cuts, not for unattended pipelines. We do not offer CI signing and we do not support workarounds that try to keep an authorisation session open. If every commit has to be signed without a human present, neither of these two options is the right purchase, and we would rather say that here than after you have paid.
Plan the signing step as a deliberate release action, not as a build flag.
What Klarseal sells
Cloud certificates, both standard and EV, on Certum’s SimplySign platform. If your policy genuinely requires a physical token, tell us — we would rather point you somewhere else than sell you the wrong thing.