TLDR: if your plugin is one file going to one folder, a ZIP with clear instructions gives your users a smoother, less alarming experience than an unsigned installer, and costs you nothing.

Sharing the findings here in case it saves someone else a day of research.

My plugin is a single VST3 on Windows. Bundled presets/images/fonts/audio assets (for simple Audio Loop Players). That means one file, one destination folder. So the installer would exist mostly for polish, not necessity.

Here's why I dropped it.

The problem: an installer is an .exe, and an unsigned .exe looks scary

If you ship an unsigned installer, SmartScreen will greet your users with the "Windows protected your PC" screen, and they have to click "More info" then "Run anyway" to proceed. I'm sure most Windows users, especially music producers, are used to this, but for a paid product from a developer they've never heard of, that's bad optics. I'd argue worse than no installer at all.

Option 1: Azure Trusted Signing. Blocked for me.

This is the modern route everyone recommends, and it's cheap. But it's only available to individuals in the US and Canada. In the UK you need a registered (Limited) company. I'm still a sole trader with no Ltd, and I'm not registering a company and wading through Azure bureaucracy just to unblock a release. Registering is on the roadmap but not worth bumping it up for this.

Option 2: An individual code signing cert. Possible, but underwhelming.

There is a middle path: Individual Validation (IV) certs. SSL.com and Certum both sell these to individuals with no company required, verified via passport and a face scan, turnaround in days not weeks. Certum even has a "Cloud CODE Signing for Individual Developer" product that a company literally cannot buy.

But here's the catch that killed it for me: signing removes the "Unknown publisher" label, but SmartScreen reputation still builds up gradually per certificate. A fresh cert with no reputation can still trigger warnings. So you pay, you do the ID verification dance, and your users may still see scary screens for a while. And from March 2026 the CA/B Forum caps code signing cert validity at 458 days, so this becomes a recurring chore, not a one-off.

The realisation: no .exe, no problem

SmartScreen cares about executables. A ZIP containing a .vst3 and a text file doesn't trigger any of this.

So the Windows release is:

• MyPlugin.vst3
• INSTALL.txt ("Copy MyPlugin.vst3 to C:\Program Files\Common Files\VST3 and approve the admin prompt")
• LICENSE.txt

That's the whole install. VST3 has one canonical system folder, so there's no per-DAW path confusion like the old VST2 days. I shipped earlier plugins as VST2/VST3 and had some support tickets, but those were usually because of the VST2 confusion. Oh, and I'm clearly not doing AAX either - another axis of complexity avoided.

The installer isn't dead, just deferred

When I register as a company, I'll 100% ship an Azure cloud-signed installer. Shipping an unsigned one in the meantime would be a downgrade from the ZIP.

One extra risk: the ever-annoying Anti-Virus checks on Windows, and two practical mitigations. [1] Submit the ZIP and the .vst3 to Microsoft's file-submission portal once the release build is final (it whitelists the hash and hugely reduces the block-at-first-sight risk), and [2] run the final binary through VirusTotal before release so I know which of the ~70 engines flag it, if any. Both are free and take minutes.

Very open to having my mind changed here, but given the fact that I've been distributing my previous (non-HISE) plugins for 3 years on Windows via the ZIP > extract > copy to folder method, I think this is a no-brainer approach for my first couple of self-contained HISE plugins.