diff --git a/.signpath/README.md b/.signpath/README.md
index 6bc608a..d5e02ee 100644
--- a/.signpath/README.md
+++ b/.signpath/README.md
@@ -1,7 +1,9 @@
 # Code signing with SignPath: prepared, off until switched on
 
-CryptBridge has applied to the [SignPath Foundation](https://signpath.org) for free
-code signing of its Windows files. Everything for it is prepared here and in
+CryptBridge plans to use free code signing from the [SignPath Foundation](https://signpath.org)
+for its Windows files. A first application in October 2026 came too early: the Foundation
+asks for more public visibility (stars, forks, external mentions), and is happy to review
+it again later. Everything for it is prepared here and in
 [`release.yml`](../.github/workflows/release.yml), but **it stays off** until it is
 switched on below. Until then every release is built and published exactly as before,
 unsigned, and its release text says so.
diff --git a/CODE_SIGNING.md b/CODE_SIGNING.md
index ecf97e9..d7c569c 100644
--- a/CODE_SIGNING.md
+++ b/CODE_SIGNING.md
@@ -1,11 +1,14 @@
 # Code signing policy
 
-Free code signing provided by [SignPath.io](https://about.signpath.io),
-certificate by [SignPath Foundation](https://signpath.org).
-
-> **Status:** CryptBridge has applied to the SignPath Foundation. Until the
-> signing is active, `CryptBridge.exe` is not signed. Every release says in
-> its text whether its exe is signed.
+> **Status:** `CryptBridge.exe` is not code signed yet. Free code signing
+> through the [SignPath Foundation](https://signpath.org) is planned as soon as
+> CryptBridge is known well enough to qualify. Everything for it is prepared, and
+> this policy already describes how it will work. Every release says in its
+> text whether its files are signed.
+>
+> Once signing is active: free code signing provided by
+> [SignPath.io](https://about.signpath.io), certificate by
+> [SignPath Foundation](https://signpath.org).
 
 ## What is signed
 
diff --git a/README.md b/README.md
index 616eb93..5f227c3 100644
--- a/README.md
+++ b/README.md
@@ -244,8 +244,8 @@ The [release notes](https://github.com/burnersen/CryptBridge/releases) say what
 
 > **Windows SmartScreen** may warn because `CryptBridge.exe` is not code signed yet. Choose *More info* >
 > *Run anyway*. Every release is built by GitHub Actions from this repository, and free code signing
-> through the [SignPath Foundation](https://signpath.org) is applied for: see the
-> [code signing policy](CODE_SIGNING.md).
+> through the [SignPath Foundation](https://signpath.org) is planned as soon as CryptBridge is known well
+> enough to qualify: see the [code signing policy](CODE_SIGNING.md).
 
 ## Uninstalling