See for yourself
A tool with admin access to your servers should not be a black box. sslbrain’s code is source-available: you can read the code that runs on your appliance and the scripts that run against your servers before you adopt them. Source-available means the code can be inspected and security reviewed; it is not an open source license.
Signed by hand, not by a pipeline
Every agent package is signed with ECDSA P-384 on a YubiKey that requires a physical touch per signature. A compromised build server therefore cannot publish code in our name. The signature embeds both the date and the agent’s category, so a package can neither be backdated nor silently change what it is allowed to do.
You decide what gets updated
With TrustSignedBefore you set a date, and your installation rejects anything signed after it until you approve. Combined with a per-server ScriptPolicy, you decide exactly which code may run in your environment. The principles are laid out on the features page.