Boring Technicalities of Code Signing

For posterity, here is an embed of some discoveries about code signing certificates.  What I've been trying to do lately is to sign and distribute an Office plugin, using the ClickOnce installer system for VSTO (Visual Studio Tools for Office).

Short story: don't use Thawte certificates until they start including something called an AIA in their code signatures.

Long story: http://social.msdn.microsoft.com/Forums/en-US/vsto/thread/44841131-58e7-4b8a-add2-a9cff869b82e/

Error:  "Customized functionality in this application will not work because the certificate used to sign the deployment manifest for MyPlugin.vsto is not trusted."

Solution: Use VeriSign.  (Or someone else -- I now just need to figure out which other vendors are doing it right.)