JPEG also supports lossless compression.
Technically, the spec does require it, but given that we’re in a thread about ecosystem support for a file format that’s approaching its 15th birthday, it’s worth considering how many image viewers will actually be able to work without the DCT step that is the essence of what typical JPEG does.
I don’t have a Windows machine handy to test, but it’s entirely possible that maybe lossless JPEG won’t display in its default viewer.

Since you’re still a Windows user at least for now, and assuming that you’re planning on continuing to be open-source, I can recommend Certum for this. https://shop.certum.eu/open-source-code-signing.html
I gave up trying to initialize the USB thingy using Linux (I tried regular Arch [btw] and an Ubuntu distrobox IIRC), but once I got through the initial steps using Windows, I was able to sign ongoing builds with Linux just fine. It took a LOT of trial and error since there seem to be very few people who simultaneously
I didn’t renew after my first year - I switched from publishing an executable to publishing it on the web, so I no longer had a need for it - so I don’t know how things have changed (if at all). Most of my information came from eventually stumbling upon this wiki page for a Ruby-based tool where they figured out the last bits I needed to get it to work.