Remote signer + key vault support

[hamza-usmani]

Many CI pipelines don't store .pfx certificates locally so we should support remote signers/key vaults
winapp sign --azure-keyvault=<vaultUrl> --cert-name=<name>

[azchohfi]

I don't think we should get into the details of using an azure key vault directly. We work with PFXs, and Azure CLI supports downloading the PFX (az keyvault certificate download --file ...).

[hamza-usmani]

Just like how we are (in another issue) discussing store cli support, then I could imagine the same thing for Azure.

[azchohfi]

It feels to me that this is a specialization that doesn't help much, and bloats the CLI to do something it was not designed to do.
To me, these are two separate concerns:

1. Acquiring the cert
2. Using the cert

I don't believe the CLI should authenticate with Azure, download the certs, to then use it because this falls into 1. The cert could come from multiple different places. Azure KeyVault is just one place, and this would be locking us into AKV, which doesn't make sense to me, since it would be an artificial dependency.

For the Microsoft Store, there is only one store, so I'm not as resistant there, but you can see in my latest comment that I'm also concerned about the exact same thing (separation of concerns).

Our existing approach is more generic (and yes, maybe a little more verbose). Give me the pfx, and I'll use it.

It is also more aligned with how other tools do this, like openssl, git, signtool, docker, nginx, and many more, which uses certs, but don't care how or where it came from.