I'm currently trying to build an updater for my software. So far this is not a hard task but I'd like to sign files in order to prevent harm in case these get hacked and modified (as it would allow installing harmful software).

I found some tutorials on MSDN and in various blogs which perfectly show how to sign an XML file. Got this working - I have a signature appended to my file.

The thing that somehow isn't covered is: How does validation work on different computers? I don't get how I should provide the necessary data to validate it. As far as I understood I need the private key in order to validate the signature (which contains the public key). Now how would I provide that one? If I simply store it in the application, it can be grabbed easily, even if encrypted.

Another possible approach I've tried was to embed a X509 certificate. I even got some code to generate such one, but then it'll always show that the certificate comes from an unknown source.

Is there any way without prompting the user for installing certificates? Or better without installing stuff at all?

So far I haven't found anything on that matter.