The required "key" program is unsigned because it is the craftwork of an independent software developer who is a California resident and a wanderer with no fixed physical address, and who does not want to incorporate.

Code signing is also expensive and complicated, and those costs would be passed on as an increased subscription price. If you subscribe, you will know, and be able to prove, that the unsigned key program was emailed to you by servers controlled by the IDEAFARM.COM domain owner. That is a valuable domain, and its owner has an economic incentive to maintain IDEAFARM.COM's good reputation, both with the payment processor (Stripe) and in the market. Knowingly sending a key program to you that contains malware is a wobbler felony punishable by up to three years in state prison and/or a $10,000 fine. (California Penal Code 502(c)(8)) Sending you malware would also create civil liability for compensatory and punitive damages and for your attorney's fees. (California Penal Code 502(e)) The owner of IDEAFARM.COM wrote all of the software involved, including the order fulfillment system, so malware can't be inserted without his knowledge. He's not going to send you malware; that would be very stupid.