windows – 在ClickOnce部署中使用证书对应用程序进行签名

在第ClickOnce and Authenticode条中,我读到：

For ClickOnce applications,you must have an Authenticode certificate
that is valid for code signing. You can obtain a certificate for code
signing in one of three ways:

1. Purchase one from a certificate vendor.

2. Receive one from a group in your organization responsible for creating
   digital certificates.

3. Generate your own certificate with MakeCert.exe,which is included
   with the Windows Software Development Kit (SDK).

在我的情况下,2号不适用.

我读了几行后：

By default, ClickOnce applications signed with self-certs and deployed
over the Internet cannot utilize Trusted Application Deployment.

(强调我的.)

我默认无法理解这个含义.在我的情况下,选项#3是否可能？

然后,为了理解所有可能性,#1意味着什么？ (“从证书供应商处购买一件”)我应该购买什么样的证书？哪个certificate authority可以推荐？取决于我应该选择什么？证书费用是多少？