Feature request: Export the signing certificate

[jozefizso]

Add an option that writes the public information of the certificate used for a signing operation to a .cer file.

Is your feature request related to a problem? Please describe.
We publish signed nuget packages to NuGet Gallery. It requires us to manually upload the certificate to the account so Gallery can verify package validity.

We are using Azure Artifact Signing which rotates signing certificates daily. Our release scripts and automation are extracting the certificate information from signed nuget package using the Knapcode.CertificateExtractor tool.

Describe the solution you'd like
A new optional argument --certificate-output <path-to-certificate.cer> which will save the certificate to the file when the argument was set.

Describe alternatives you've considered
We must install the Knapcode.CertificateExtractor dotnet tool and use it to extract certificate data.

GitHub Actions example

- name: Sign artifacts
  shell: pwsh
  run: >
    ./sign code artifact-signing
    **/*.nupkg
    --certificate-output "${{ runner.temp }}\signing-certificate.cer"

- name: Publish certificate path
  id: signing-certificate
  shell: pwsh
  run: '"certificate_file=${{ runner.temp }}\signing-certificate.cer" >> $env:GITHUB_OUTPUT'

Later steps can use steps.signing-certificate.outputs.certificate_file to inspect, archive, or upload the certificate required by NuGet Gallery.

Benefits

• Automation always receives the certificate that actually signed the artifacts.
• Certificate rotation does not require scripts to predict or separately retrieve the active certificate.
• The output is safe to share with downstream steps because it contains only the public certificate.