Free and cheap routes for open-source projects
SignPath Foundation (free). It signs from your CI with a key on its HSM. The certificate is issued to SignPath Foundation, so users see the Foundation as publisher, not you. Your project must be under an OSI license with no commercial dual-licensing and no proprietary parts, be maintained and already released, and follow its rules: MFA for every member, review of outside changes, an approval for each signing. Security-scanning tools are refused.
Certum Open Source Code Signing, for individuals. The certificate is in your own name, prefixed "Open Source Developer", and only for non-commercial software: Certum revokes it if it signs software that is sold. Two versions: in the cloud (SimplySign, $58, works from CI) or on a smart card with a reader (about €69 with VAT, plus courier), which is awkward in CI.
If you ship through the Microsoft Store as MSIX, the Store signs the package for free. An MSI or EXE listed in the Store still needs your own signature. In the US or Canada, Azure Artifact Signing at $9.99 a month is the cheapest signature in your own name.