diff --git a/docs/RELEASING-WINDOWS.md b/docs/RELEASING-WINDOWS.md
index c8c26e1..658d805 100644
--- a/docs/RELEASING-WINDOWS.md
+++ b/docs/RELEASING-WINDOWS.md
@@ -154,6 +154,23 @@ warning, and the SHA-256 is the only integrity check. This is the significant
 remaining gap before wider distribution: a checksum published next to the file
 protects against corruption, not against someone who can write to that location.
 
+The decision taken is to wait for a certificate from the organisation's own
+certificate authority rather than buy one from a public CA. Every server this
+installer runs on is centrally managed, and that CA's root is already trusted on
+those machines, so an internally issued Authenticode certificate removes the
+warning exactly where it matters. A public certificate would buy trust on
+machines this software never reaches.
+
+Until then, publish the SHA-256 through a channel SEPARATE from the installer
+itself. A hash sitting beside the file is only as trustworthy as write access to
+that location; a hash the operator gets another way means tampering has to
+succeed twice.
+
+Wiring it up afterwards is small: Inno has native SignTool support, so a
+directive in the script and a signtool configuration on the build machine sign
+the installer and its uninstaller. Include a timestamp server, or signatures
+stop verifying when the certificate expires.
+
 **Compiling requires Windows.** `build-installer.ps1` exists so the whole
 process can run on a Windows workstation. Nothing about it runs in CI, so a
 release is a deliberate act by a person.