Correct release notes and docs: signing is not active

.github/workflows/release.yml

@@ -305,14 +305,18 @@ jobs:
             desktop app, superseded by the Electron client above. It is still
             built so existing setups keep working.
 
-            ## Code signing policy
-
-            Free code signing provided by [SignPath.io](https://signpath.io),
-            certificate by [SignPath Foundation](https://signpath.org).
-
-            Committers and reviewers: [repository maintainers](https://github.com/dbisina/relay/graphs/contributors).
-            Approvers: [repository owner](https://github.com/dbisina).
-            Every release is approved manually before it is signed.
+            ## About the security warning
+
+            These builds are **not code-signed** yet, so Windows SmartScreen and some
+            antivirus tools will warn on first run. This is expected for a project this
+            new: free signing from [SignPath.io](https://signpath.io) requires more
+            public usage history than the project has built up so far, and a paid
+            certificate is not yet in place. Neither means the binary is unsafe, only
+            that it has no publisher reputation attached to it yet.
+
+            To run it anyway on Windows: click "More info", then "Run anyway" on the
+            SmartScreen prompt. Verify the download matches `SHA256SUMS` first if you
+            want extra assurance.
 
             Relay runs locally and will not transfer any information to other
             networked systems unless specifically requested by the user or the

README.md

@@ -253,14 +253,19 @@ Repo map for contributing agents: [CODEMAP.md](CODEMAP.md). Agent rules: [CLAUDE
 
 ## Code signing policy
 
-Release binaries and installers are code signed so Windows and macOS can verify
-they came from this project and were not modified after they were built.
+Release binaries and installers are **not code signed yet**. Windows
+SmartScreen and some antivirus tools will warn on first run as a result;
+click "More info" then "Run anyway", or verify the download against
+`SHA256SUMS` first if you want assurance beyond that.
 
-Free code signing provided by [SignPath.io](https://signpath.io), certificate by
-[SignPath Foundation](https://signpath.org).
+Relay applied to [SignPath.io](https://signpath.io)'s free open source
+signing program (certificates from [SignPath Foundation](https://signpath.org))
+and was told the project needs more public usage history to qualify. The
+team-roles structure below is the precondition SignPath requires before
+reapplying.
 
 - **Committers and reviewers:** [repository maintainers](https://github.com/dbisina/relay/graphs/contributors). Changes from outside the maintainers arrive as pull requests and are reviewed before merge.
-- **Approvers:** [repository owner](https://github.com/dbisina). Every release is approved manually before it is signed.
+- **Approvers:** [repository owner](https://github.com/dbisina). Once signing is active, every release will be approved manually before it is signed.
 
 Relay runs locally and will not transfer any information to other networked
 systems unless specifically requested by the user or the person installing or

docs/code-signing-policy.md

@@ -1,11 +1,18 @@
 # Code signing policy
 
-Relay's release binaries and installers are code signed so that Windows and
-macOS can verify they came from this project and were not tampered with after
-they were built.
-
-Free code signing provided by [SignPath.io](https://signpath.io), certificate by
-[SignPath Foundation](https://signpath.org).
+**Current status: Relay's release binaries and installers are not code
+signed yet.** Windows SmartScreen and some antivirus tools will warn on
+first run as a result; this does not mean the binary is unsafe, only that
+it carries no publisher reputation yet. Verify a download against
+`SHA256SUMS` below if you want assurance beyond that.
+
+Relay applied to [SignPath.io](https://signpath.io)'s free open source
+signing program (certificates from [SignPath Foundation](https://signpath.org))
+and was told the project does not yet have enough public usage history to
+qualify. This page, and the team-roles structure below, exist as the
+precondition SignPath requires before reapplying once that changes. A paid
+certificate is the other path back to signed releases and is not currently
+in place either.
 
 ## Team roles
 
@@ -19,11 +26,11 @@ Relay is maintained in the open at
   request for a release is approved manually. No release is signed
   automatically without that approval.
 
-## What gets signed
+## What will get signed
 
-Only artefacts built by this project's own release pipeline
-([`.github/workflows/release.yml`](../.github/workflows/release.yml)) from
-source in this repository:
+Once signing is active, only artefacts built by this project's own release
+pipeline ([`.github/workflows/release.yml`](../.github/workflows/release.yml))
+from source in this repository:
 
 - the `relay` daemon and CLI binary,
 - the Electron desktop installers (`.exe`, `.dmg`, `.AppImage`),
@@ -67,7 +74,7 @@ Get-FileHash .\Relay-<version>-windows-x64-setup.exe -Algorithm SHA256
 
 ## Reporting a problem
 
-If you believe a signed Relay artefact violates the SignPath Foundation code of
-conduct, please open an issue at
+If you believe a Relay artefact (signed or not) violates the SignPath
+Foundation code of conduct, please open an issue at
 [github.com/dbisina/relay/issues](https://github.com/dbisina/relay/issues) and
 contact `support@signpath.io` with details.