Which EV code signing and cloud HSM providers are worth considering?

DigiCert KeyLocker sounds like a reasonable premium option to investigate for this setup. Before committing, ask for a quote based on your expected signing volume and have them walk through the CI/CD integration and delegated access for the overseas team.

I'd also ask support how they handle validation when the business registration and operating locations differ. The product may fit, but you want to know what the onboarding process will actually require.

SSL.com eSigner is another candidate, though the volume-based cost deserves a close look. Ask for a breakdown based on both normal build activity and release peaks, rather than just comparing the starting subscription price.

For validation, check whether they can use a Dun & Bradstreet registration and whether rush processing is available. Rush processing may help with timing, but get the requirements and price confirmed before ordering.

Azure is worth looking at too. Azure Key Vault has been used for code signing setups, but check the certificate side separately. A hosted key service and an EV certificate are not necessarily the same purchase.

Specifically, ask whether the Azure option you choose can issue the certificate directly or whether you need a third-party certificate, and how the key gets provisioned without a token or self-hosted attestation. Also confirm the signing workflow supports your pipeline and remote developers before treating it as a direct replacement.