Signed serial, explained
Signed serial: A serial number that carries a cryptographic tag computed from a secret key, so only the key holder can create valid serials.
An ordinary serial number can be guessed or invented. A signed serial includes a short tag derived from the serial and a secret key, such as a message authentication code.
A verifier holding the key can recompute the tag and reject any serial that was not issued by the brand, even if it looks well formed.
How Satyakod handles it
Satyakod derives a separate key for every batch inside AWS KMS, so keys never leave the key service and one batch’s key cannot sign another’s codes.