KEYSUITE PUBLISHER CERTIFICATE
=============================

KeySuite 2026.11 introduces a new public code-signing certificate. The installer
and Office add-ins are signed with this identity. The public certificate does
not contain the private signing key.

Subject: CN=KeySuite Code Signing 2026.11
Thumbprint: F5B89DB3E1AAC20867D8221E8DEB2861BE8D3679
Public CER SHA-256:
5F9C336F730AC40F5532C78A16B3F5E52BAFF38DAA732838A8EC2BA2F9FE7278
Expires: 20 October 2029

INTERACTIVE INSTALLATION

Setup adds the public certificate to your personal Trusted Publishers store if
it is not already present. If root trust is missing, setup opens the Windows
Certificate Import Wizard, fixed to your personal Trusted Root store. Review
the identity and approve only if your organisation permits it. Existing user
or machine trust is preserved without an unnecessary repeat import.

This affects Windows trust, not just Office. Macros and software validly signed
with this certificate may be trusted. Setup does not change Office macro policy,
Windows Hello, passwords, credential providers, or machine-wide trust stores.
Company policy can prevent or ignore user-managed trust; setup does not bypass it.

If you cancel or policy blocks trust, installation still completes with a warning
and does not open training guides. Do not launch Office until IT resolves trust.
Customer testing found that trusting the previous release certificate resolved
reported slow PowerPoint and Windows sign-in symptoms. The internal Windows
mechanism is unknown; the new release still needs affected-machine validation.

SILENT / ENTERPRISE DEPLOYMENT

Run setup in the intended user's profile. Silent setup never imports a root,
never opens the certificate wizard, and never launches Office. IT must provision
this exact public CER into Trusted Root Certification Authorities and Trusted
Publishers using approved Group Policy / Intune procedures before Office is used.
Do not change company policy or run this per-user installer as SYSTEM.

Logs: %LOCALAPPDATA%\KeySuite\logs\certificate-trust.log
Ownership records: HKCU\Software\KeySuite\CertificateTrust\v1\<thumbprint>

UNINSTALLATION AND UPGRADES

Upgrades preserve trust and its ownership records. Interactive uninstall removes
only exact user-store entries whose installer ownership markers still match.
It preserves pre-existing and IT-managed entries, and all machine-store entries.
Windows may request confirmation for removal from the personal Root store.

Silent uninstall defers owned Root removal to IT so no Windows prompt can block
unattended removal. The log and ownership record remain for that review. IT must
confirm that other KeySuite installations/releases do not still need the trust
before removing the exact certificate. Never delete certificates by name alone.

The certificate files are public and safe for IT to inspect. Never request or
distribute a KeySuite PFX, P12, private key, or signing password.

Support: info@thekeysuite.com
