Ask HN: As indie-developer, which code-signing do you use for your .exe files?

Your customers download your software as .exe (or ZIP containing the .exe, or an installer that eventually installs your .exe program).

When they first open the software (that needs to run as administrator to fully work), they see:

"Windows SmartScreen prevented an unrecognized app from starting..."

and then a second message:

"Do you want to allow this app from unknown publisher to make changes to this computer?"

This doesn't look good for a customer who buys a product.

What code-signing solution do you use to avoid this?

* certum.eu

* digicert.com marketed as "As low as 474$/year" (!)

all look quite expensive for an indie developer.

Which solution do you use/recommend?

PS: The project LetsEncrypt is not involved in code-signing, and a forum post confirms they don't want to get involved in it.