title: Signing code for Github -> MyGet -> Nuget
body: <p>We have a piece of .NET code that deals with integration against our platform. We want to share this with others to make it easier to integrate with us. </p>
  
  <p>Reading on-line, the approach of using GitHub for source, MyGet for CI builds and Nuget for release builds seems like a very attractice solution. </p>
  
  <p>We have some security people that are starting to ask some questions.</p>
  
  <p>How can consumers ensure that the package they downloaded is actually from us?
  In case someone else sets up a feed with a name similar to us, with modified code. </p>
  
  <p>Code signing seems to be the way to go, but where do we store the certificate? I have browsed various other github repos, and some store a snk file, others have a reference to a pfx file somewhere outside source control.</p>
  
  <p>How can one integrate something like this with the build process in MyGet? Do we do unsigned builds to MyGet, and then have some additional step when performing final publish to NuGet?</p>