Implement a secure continuous deployment using Azure Pipelines
You are updating a YAML release pipeline that signs an MSIX package with
release-signing.pfx. The certificate must not be committed to the repo, and the signing command needs the certificate file path at runtime. Which approach should you use?