Trusted signers is a NuGet security control that allows package restores only from approved signing identities. Instead of trusting any package that claims to be signed, the build policy checks the signer’s certificate or authoring identity against a curated allowlist.
This matters because package signatures help confirm origin and reduce the chance that a typosquatted or tampered dependency is accepted during restore. In attacks, adversaries may publish lookalike packages that copy a popular library’s name and behavior, hoping developers install them without noticing. Trusted signers makes that harder by rejecting packages signed by unknown or unapproved certificates, even when the package name looks legitimate. In defense, teams combine trusted signers with exact package IDs, version pinning, and signed-package enforcement to narrow the supply-chain risk. It is especially useful in .NET environments where dependencies are restored automatically and a single untrusted package can enter many builds.