What is the story around signing VS Code extensions? I see that the vsce tool can package and publish .vsix files but there doesn't appear to be an option to sign them. I believe that .vsix files can be signed (https://docs.microsoft.com/en-us/visualstudio/extensibility/signing-vsix-packages).

What options do we have if we want to have stricter validation of the .vsix packages that we distribute and that our users install?