Microsoft offers a service called Azure Artifact Signing (used to be called Trusted Signing) that manages code signing for you:
https://azure.microsoft.com/en-us/pricing/details/artifact-s...
It's $9.99/mo, and you don't need to worry about procuring or renewing code signing certs.