We paid for Windows code signing — and new users still see a scary blue warning
One unexpectedly hard part of shipping a Windows app has been earning user trust before they even reach the product.
We bought a code-signing certificate and signed the Speecher installer. The installer is legitimate and the certificate is valid — but Windows SmartScreen can still show the blue “Windows protected your PC” warning because the publisher has not built enough reputation yet.
From a founder’s perspective, this is a strange loop: people need to install the app for the reputation signal to grow, but the warning makes the first people understandably hesitate. We can explain the warning, publish hashes, and use the official download domain, but each extra reassurance step hurts activation.
For founders who have shipped Windows desktop software: how did you handle the first months of SmartScreen reputation? Did you change distribution, use the Microsoft Store, use an EV certificate, or simply wait it out? I’d especially value advice on what reassures a cautious non-technical user without sounding defensive.
We hit the same wall on macOS with Gatekeeper. A paid Developer ID certificate and full notarization were not enough by themselves, Apple's reputation system still needed real install volume before the warnings actually eased up. What moved the needle faster than the certificate was distribution through channels where someone already vouches for you, a community that trusts the person posting, rather than a cold download link on a landing page. The SmartScreen warning is really measuring trust in the publisher, not the binary, so a few hundred installs through a referral people already trust is probably worth more right now than an EV cert. Screenshots that explain the warning before someone hits it is the cheapest fix, and it is the one I would ship first.
This is such a classic Windows trust chicken-and-egg. Signing alone rarely kills SmartScreen early — reputation / install volume does.
One framing that helped me when talking to non-technical buyers: treat the blue warning as expected for the first weeks, put a 15-second "what you'll see / why it's fine" screenshot on the download page before they click install, and offer Microsoft Store as the "I don't want to think about this" path.
Curious whether an EV cert actually moved the needle for you vs just waiting for reputation to accumulate.
Microsoft Store is worth treating as a separate acquisition path, not just a fallback. We ship DictaFlow on Windows too, and the Store gets the SmartScreen conversation out of the way for cautious buyers, while a signed direct download still gives technical users a faster path. I'd put both on the download page and track download-to-first-dictation separately. If Store users activate better, you've got proof that trust, not the warning copy, is the real bottleneck.
The interesting challenge isn't getting Windows to trust your installer—it's giving new users enough confidence to install before platform reputation has caught up. I'd keep validating whether reducing perceived installation risk has a bigger impact on adoption than any distribution channel or certificate upgrade.
I'd stop trying to explain SmartScreen inside the same flow that triggered it. Offer two paths: Microsoft Store for cautious users and the signed direct installer for technical users, then measure download-to-first-launch separately. If the Store path wins despite extra friction, the bottleneck is trust distribution, not installer quality.