NuGet sign command needs to support updated private key storage requirements

[dtivel]

NuGet Product Used

NuGet.exe

Product Version

latest

Worked before?

No response

Impact

Other

Repro Steps & Context

The current version of CA/B Forum's baseline requirements for publicly trusted code signing certificates requires that starting November 15, 2022, that private keys remain entirely within a hardware crypto module or a cloud-based hardware crypto module. This means that NuGet's sign command, which supports private keys in a local certificate store or a PFX file will be impacted by this change. It may be difficult for package authors to sign their packages, especially in CI/CD pipelines.

See section 6.2.7.4 "Subscriber Private Key protection and verification" in Baseline Requirements for the Issuance
and Management of Publicly‐Trusted Code Signing Certificates, version 3.0 (June 22, 2022) for details.

CC @clairernovotny, @aortiz-msft

Verbose Logs

No response

[erdembayar]

Related issue: #11930

[nkolev92]

Team triage: Assigning to @clairernovotny for now for the initial discussions.

[LTRData]

Are there any updates to this? It surprises me a bit that we still cannot sign NuGet packages due to the requirements of having the private key in a file.

[iamjplant]

This sounds similar to the issue ( #11437 ) I wrote.