Windows Signed Installer

Nobody has claimed this yet.

Windows XP and higher puts restrictions on desktop installers:
* Microsoft Edge and IE11 [warn about the download of untrusted executables if there is not a valid file signature](https://cloud.githubusercontent.com/assets/6345473/26710974/5fb210c8-472b-11e7-87b8-d43d74eaa58d.png).
* A [smartscreen filter](https://cloud.githubusercontent.com/assets/6345473/26710997/79250cea-472b-11e7-9b51-fd9b2fb3a44e.png) prevents the installer from being run until it has been downloaded enough times
* An [untrusted dialog appears](https://cloud.githubusercontent.com/assets/6345473/26711032/b0ba936e-472b-11e7-8061-c8e6ac43f538.png) when the installer is run, presenting a dangerous warning to the end-user if the publisher is not "verified".

Assuming we don't use the [crippling Windows Store](http://www.pcworld.com/article/3099954/windows/epic-ceo-how-microsoft-is-plotting-to-cripple-steam-and-seize-control-of-pc-gaming.html), there is really only one way to sign desktop installers: `SignTool/Authenticode`. Several 3rd party tools provide the crypto tools if we need to avoid Microsoft tools (e.g. nsis/travis/etc)

We have two main options:
* Use a [standard, trusted SHA256 software signing certificate](https://www.digicert.com/order/order-1.php) (about $200 annually) with timestamp validation. This will fix everything except the SmartScreen filters
* Use an [Extended Validation SHA256 software signing token](https://www.digicert.com/code-signing/ev-authenticode-certificates.htm) (a USB stick) with timestamp validation. This will fix SmartScreen filtering as well, but tends to be OS (Windows) and hardware (USB) dependant.

Obtaining a certificate requires a background investigation on the organization. For example, DigiCert will require proof that an organization is a physical entity, can answer the phone, etc. Although operate similar to a business, we're technically not, putting us in a Catch-22. This is a fairly common problem with open source projects such as LMMS as the developers are generally individuals and not a specific organizational entity.

I would like to reach out to the major CAs that offer these certificates and see if any of them offer sponsorship programs for large projects, such as LMMS, since it worked so well with our hosting provider, NetworkRedux.

If we can't find a sponsor, we may be able to raise the funds necessary, or we may close as `wontfix` and decide to leave our installer with all of its warnings.

Note, Windows XP -- if we decide to support it -- requires an SHA1 signature to suppress dialogs. Dual signatures (SHA1 + SHA256) are supported in `.exe`, so this is generally not a problem if the Certificate Authority is OK issuing a legacy cert as part of our sponsorship/purchase.

Start by reviewing the Windows installer release process and the SignTool/Authenticode options described in the issue. Investigate whether a certificate authority offers sponsorship or whether funding can be obtained; account for timestamp validation and the SHA1 plus SHA256 requirement for Windows XP. Done means the project has a signing path or a documented decision to leave the installer unsigned.

Written by the indexing model from the issue text.