If signature checking is enabled then proper signing of every singal executable run is absolutely imperative. Each and every executable must must be signed in a way that passes the signature checking, or else the show-stopper Error 21 is going to result.

There are ways of disabling effective signature checking which may be much more convenient than frequently re-signing XBE files, but the executables that actually disable the effective signature checking may need some attention to make sure they are properly signed.

The software

What choices exist?

XBEDump

Any kind soul who wishes to port XBEDump's re-signing functionality to an Xbox executable would be greatly appreciated. I may do this myself once the OpenXDK is solidly working with GCC. As of this writing, nobody has ported XBEDump to the Xbox (that I know of), so all signing of executables must be done on a PC and then the resulting files transfered to an Xbox.

The first step in using XBEDump is to download it. Version 0.5 can be found in multiple locations:

For those who know how to deal with command lines, the command line most people will be wanting to use is:

xbedump filename.xbe -habibi
(Note: the -shabibi option is typically not what people want.)
This will create a new file called OUT.XBE which will be signed. This, rather than the original file given on the command line, is what will be useful. Make sure there is not an OUT.XBE file (just to make sure there is no confusion as to what made the file), then run this program with the right command line, then use the resulting OUT.XBE file.

Running XBEDump with no parameters will show a help screen but not a version number. To find the program's version number, run it on a valid XBE file and check out the first line in the output (by capturing the output, since the first line will likely (or perhaps it is even guaranteed to) scroll off a 25 row screen).

The signatures

The way Microsoft planned things, every Xbox software would have a signature that Microsoft created. Because of the successful encryption techniques used, only Microsoft can create valid signatures.

Microsoft's failure is that the code which checks signatures is relatively modifiable. For example, nkpatcher is a program that disables the signature checking entirely. Some other software packages will modify the signature checking to allow executables using one of the known signatures.

Some known signatures are relatively easy to create (likely because they are less complete, but they are satisfactory enough to pass some modified signature checking). The two most common ones are:

Habibi signature
The most common signature today. Named after the person who created the 007: Agent Under Fire hacked saved game, this signature is also used by the MechAssault and Splinter Cell saved game exploits as well as newer XBE hacks such as UDE2.
Font Hack signature
Used by some of the older font hacks. This is losing popularity since the newer font hacks (I think Double Dash, UDE, and UDE2 all use Habibi) no longer use this signature, and this signature isn't usable by the exploiting packages of hacked saved game data. Many older programs may be signed with a font hack, and for those who are using Habibi-based solutions, any such program will need to be signed.
Audio signature
Some other signature. Actually, I've been thoroughly confused by this one, keeping the audio hack separate from Habibi. I think they are different, but that all the audio hacks that used this signature have been modified to support the Habibi signature. Therefore, I suggest just avoiding the use of this entirely. If you have a hack that uses the Audio Signature, my recommendation is to find a different version of the hack that uses the Habibi signature.
Unsigned
The official Microsoft XDK, being used unofficially as it is whenever homebrew software is made with it and distributed, makes "unsigned" software. (Actually, I'm pretty sure that such software has a signature in the XBE file, but the signature is likely random and possibly even changing from one version of a program to the next.) Most homebrew software is unsigned, meaning the signature won't work for anybody that has any signature checking enabled. The solution that the software developer generally expects users to do is to either modify the signature of the file or, more likely, to disrupt the Xbox's signature checking before running the program.