https://www.ssl.com/certificates/code-signing/buy/
That's a yearly cost, but you only need to keep renewing if you are signing and releasing new apps or updates. Existing apps you've signed will remain valid if if you don't renew your cert (unlike websites etc.)
Also, it seems that the LARGE cost for the EV certs is only really needed for things like Windows drivers.
they do have EV for $350/annual or $750/3 year cert so I might try that it is certainly cheaper than digicert.
and yes EV is good for more than drivers, it allows EXEs to bypass smartscreen prompts that would otherwise trigger on standard certs that have to go through reputation checks in smartscreen.
Is there any 'free' Authenticode cert providers out there? Doing the same job as LetsEncrypt but for code?
It's also an outdated view:
1. Most Windows software is signed with an Authenticode cert which requires the author to prove who they are to the CA and hand over at least $99.
2. Windows these days has SmartScreen running all the time, which checks executable file hashes against a cloud based database and blocks apps with known issues. Doesn't help if it's an unknown but massively reduces the risk.
3. Windows has a policy that can be enforced that blocks the execution of any software that doesn't pass points #1 and #2.