title: How to sign code built using Azure Pipelines using a certificate/key in Azure Key Vault?
body: <p>We're in the process of moving from on-premise build servers to Azure Pipelines. We produce "shrink-wrap" desktop software so clearly we need to sign all our binaries before releasing. Our current build infrastructure does this using a USB hardware token from GlobalSign, but clearly that isn't going to work when we're doing cloud builds - sadly, clouds are not equipped with USB ports :D</p>
  
  <p>Now, GlobalSign has recently started <a href="https://www.globalsign.com/en/code-signing-certificate/" rel="noreferrer">advertising</a> Azure Key Vault as a key storage option, and they're perfectly happy to sell this to us, but I'm not sure how we'd actually integrate that with our build pipelines (or indeed whether that's even possible).</p>
  
  <p>Has anyone actually made this work?</p>