Opportunities › Code signing and installer reputation management › Proposed app
Keelmark
Watch Windows installer reputation and recover flagged signatures fast
- Score
- 34
- confidence 60
- Evidence
- 4
- items on the page
- Rivals
- 2
- named in sources
- First version
- 50 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 1996
- Mature market · AI estimate
ScreensConcept
Desktop app: Software teams review installer reputation dashboards, signing history, and recovery cases as part of release workflows and CI integration. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
Releases
Action needed2 flagged
About this appAI proposal
Keelmark watches every Windows installer you ship. After each release it downloads and runs your signed file on clean Windows test machines, records whether SmartScreen or another security prompt appears, and alerts you before your customers find out.
When a build is flagged, Keelmark opens a recovery case: which signature, certificate and file triggered the warning, drafted false-positive reports, and a tracker until the warning clears. Your CI can hold the release or point downloads at the last clean build.
It is for small and mid-size teams that already pay for code signing, through a cloud signing service or a certificate authority, and still get blocked. Keelmark does not control Microsoft's decisions. It makes blocking visible, fast to act on and easy to explain.
- Tagline
- Know your installer is trusted before your users find out it isn't.
- Voice
- CalmPreciseDirect
- Why this name
- A keel keeps a ship steady in rough water, and a mark is a signature. Keelmark is about keeping signed software steady.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Post-release reputation checks
Every new installer is fetched and run on clean Windows images. You see whether a warning appears, and what it says, within minutes.
No member yet
Signer-level alerts
If several builds under one certificate or signing identity start getting flagged, you get one alert about the signer, not a flood.
No member yet
Recovery cases
Each flagged file gets a case with evidence, drafted false-positive submissions, status and a timeline you can share with your team.
No member yet
Release hold from CI
A CI step holds a release, or switches a download link to the last clean build, when a check fails.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#0F5C5ADeep Teal · primary#F6F4EEPaper · surface#1B2A2EInk · text#E0892BAmber · accent#B3362BSignal Red · warning status#4C8A5BMoss · clean status
Typography
Aa
Keelmark
PricingAI proposal
The material gives no competitor prices. These tiers are a starting point to test, priced by number of apps, with recovery features in the top tier.
Free
Free
- 1 app
- Checks on 5 releases a month
- Email alerts
Team
$49 a month
- Up to 5 apps
- Unlimited release checks
- Signer alerts
- CI release hold
Recovery
$149 a month
- Up to 20 apps
- Recovery cases and drafted reports
- Recheck every 6 hours
- Shareable status page
Would you pay Team · $49 a month?
Your answer tells PWAS which prices people accept. It changes no score.
No answers yet.
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- Shared outputs. Teams can share a public status page and a release-check badge showing that a build passed a clean-machine check. Customers and partners who see it learn the product name.
- Do they become customers?
- Viewers are mostly end users, not other vendors, so conversion is likely low. Test whether engineers at other software companies who see the badge sign up.
- First customers
- Small independent software companies of 5 to 50 people that ship a Windows desktop installer and already pay for code signing, with an engineer who owns releases.
- Where to reach them
- Hacker News and developer forums: Join threads on SmartScreen blocking and offer a free check of a posted installer.
- Windows developer communities: Post a plain write-up of what clean-machine checks show for common signing setups.
- Direct outreach: Contact release engineers at small Windows software vendors with a free first check.
- First milestone
- Ten teams run checks on real releases and five pay for the Team plan within 60 days.
Why people already pay for this
- Public claimVendors pay for code signing services specifically to avoid SmartScreen warnings
- Public claimAzure Trusted Signing customers are experiencing widespread installer blocking despite paying for the service
- Public claimThe problem has worsened over time, affecting all installers signed with the service
- Public claimSmartScreen warnings cause reputational damage to vendors
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Windows test runnersClean Windows VM pool on demandChecks need to run signed installers on real, clean Windows images to see the prompts users see.
- This app · Job queueBackground worker with scheduled jobsRechecks, downloads and case tracking run on timers outside web requests.
RisksAI inference
- TechnicalReproducing SmartScreen behaviour in a test VM may not match what real users see, since reputation depends on download source and volume. Checks could give false comfort.
- PlatformMicrosoft decides what is flagged and may change its systems or report channels at any time. Keelmark can only detect and speed up recovery, not guarantee it.
- CommercialVendors may expect the service to prevent blocking, not just report it. Teams may also see monitoring as a feature their signing provider should offer.
- TechnicalRunning customer-uploaded executables on cloud VMs needs strong isolation, and malware abuse of the service must be prevented.
- DataAutomated false-positive submissions may be rate-limited or rejected if they look like spam. Drafts may need to stay manual at first.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.