As the manifest *should* be the same for Debug and Release builds, I think I will have to manually change the manifest before deploying a build (to require uiAccess).
  
-----------------------------------------------------------------------------------------------------------------

CREATING A CERTIFICATE AND SIGNING OptiKey:
(Taken from http://stackoverflow.com/questions/84847/how-do-i-create-a-self-signed-certificate-for-code-signing-on-windows)

1.CREATE A SELF-SIGNED CERTIFICATE AUTHORITY (CA):
makecert -r -pe -n "CN=Julius Test CA" -ss CA -sr CurrentUser -a sha256 -cy authority -sky signature -sv JuliusTestCA.pvk JuliusTestCA.cer

2.IMPORT THE CA:
certutil -user -addstore Root JuliusTestCA.cer

3.MAKE A CODE-SIGNING CERTIFICATE:
makecert -pe -n "CN=Julius Test SPC" -a sha256 -cy end -sky signature -ic JuliusTestCA.cer -iv JuliusTestCA.pvk -sv JuliusTestSPC.pvk JuliusTestSPC.cer

4.CONVERT THE CERTIFICATE AND KEY INTO PFX FILE:
pvk2pfx -pvk JuliusTestSPC.pvk -spc JuliusTestSPC.cer -pfx JuliusTestSPC.pfx

5.SIGN THE EXE FILE WITH NEW PFX FILE: (Run from exe location)
"C:\Program Files (x86)\Microsoft SDKs\Windows\v7.1A\Bin\signtool" sign /v /f "C:\OptiKey Release Staging\Certificates\JuliusTestSPC.pfx" "C:\OptiKey Release Staging\Binaries\OptiKey.exe"

-----------------------------------------------------------------------------------------------------------------

FILE TYPES:
(Taken from http://stackoverflow.com/questions/2292495/what-is-the-difference-between-a-cer-pvk-and-pfx-file)
Windows uses .cer extension for an X.509 certificate. These can be in "binary" (ASN.1 DER), or it can be encoded with Base-64 and have a header and footer applied (PEM); Windows will recognize either. To verify the integrity of a certificate, you have to check its signature using the issuer's public key... which is, in turn, another certificate.
Windows uses .pfx for a PKCS #12 file. This file can contain a variety of cryptographic information, including certificates, certificate chains, root authority certificates, and private keys. Its contents can be cryptographically protected (with passwords) to keep private keys private and preserve the integrity of the root certificates.
Windows uses .pvk for a private key file. These are in a proprietary format. Some documentation is available.
You should never disclose your private key. These keys are contained in .pfx and .pvk files.

Generally, you only exchange your certificate (.cer) and the certificates of any intermediate issuers (i.e., the certificates of all of your CAs, except the root CA) with other parties.

-----------------------------------------------------------------------------------------------------------------

Signing ClickOnce applications and manifests:
http://blogs.msdn.com/b/vsto/archive/2009/04/29/signing-and-re-signing-manifests-in-clickonce.aspx

ClickOnce Manifest Signing and Strong-Name Assembly Signing Using Visual Studio Project Designer's Signing Page:
http://msdn.microsoft.com/en-us/library/aa730868(v=vs.80).aspx

How to: Sign Application and Deployment Manifests:
http://msdn.microsoft.com/en-us/library/che5h906.aspx

What's the Difference - certificate signing vs strong naming:
http://blogs.msdn.com/b/ericlippert/archive/2009/09/03/what-s-the-difference-part-five-certificate-signing-vs-strong-naming.aspx

-----------------------------------------------------------------------------------------------------------------

Free (1 year) certificate for Open Source projects; https://www.certum.eu/certum/cert,offer_en_open_source_cs.xml
		http://stackoverflow.com/questions/1177552/code-signing-certificate-for-open-source-projects
