Has anyone here tried out that SignPath (https://signpath.org) thing mentioned in one of the responses?
From their website:
SignPath Foundation provides reliable code signing for Open Source projects.