tl;dr: Starting soon (today I hope!) all nightly windows builds will be authenticode signed. Update mars will also be signed according to the new MAR format. the long version: RelEng have turned it up to 11 over the past few weeks to build up and deploy a new infrastructure to support the silent update program. One of the requirements for this project is that all binaries, including nightly builds and updates, be signed similar to how we already do signing for releases. Our current release signing process still requires some manual work, and it's not feasible to manually sign each nightly build every day. We've developed systems for integrating signing into the build process so that nightly builds will be fully signed before they get uploaded to FTP for our nightly users to download. Incremental builds will also be signed using a different (self-signed) certificate. Our plan is to enable signing on other platforms as soon as possible, where appropriate. Please let us know if you have any problems with builds or updates as a result of this. Details are mostly in bug 509158. I'm very proud of my team on this, especially bhearsum and rail. Thanks guys! Now we'll be dialing it back to 10, our normal resting state.