Globalsign will revoke your code signing certificate no questions asked

Lesson learned: Last step of ci/cd, verify binary artifact on virus total api before shipping.