The process of creating a certificate and signing the installer is very easy.
However, it doesn't make a difference: I had to pass the installer through an FTP server for the message to actually trigger.
The installer is definitely signed, and it is possible to inspect the signature using the file properties in the right click menu (see attached screenshot).
However, as expected, there is a message telling something along the lines of "The certificate chain could be successfully traversed. However, it ended at a root certificate that isn't trusted."

The warning message that is displayed when trying to use the installer is still the same.

There is still the possibility that even the self signed certificate could gain trust over time. But I haven't found an "official" source confirming that this is the case.

Fwiw, attached are the dialogues that display when executing the unsigned Windows installer (albeit on a German locale).
The text translates approximately to:

> The computer was protected by Windows
> The Windows Defender SmartScreen prevented the start of an unknown app. The execution of the app might represent a risk to the PC.
> More information
> "Don't execute"

And in the second window:

> App: octave-5.2.0-w64-installer.exe
> Author: Unknown Author
> "Execute anyway"  "Don't execute"

An unwary user would probably not realize that they need to click on the underlined text (More information) in the first window to get the option to execute the installer anyway in the second window.


This resource [1] suggests that even a self-signed executable can gain trust over time. I don't know if this is true.
It also gives step-by-step instructions on how to sign a Windows executable with Linux tools.
Maybe we should give it a try?

[1]: https://reiners.io/signing-windows-applications-from-linux/

It should be possible to use tools from the Mono Project to sign the installer. Most parts of the Mono Project are distributed under the MIT license. [1]
I don't know if this is considered to be a "free" license by GNU.

Having said that: The code signing certificate itself is not free (of charge). I only found offers that start at above €100 for one year. [2]

If we don't have a certificate already, I don't think it is worth following up on this.

[1]: https://www.mono-project.com/docs/faq/licensing/
[2]: https://en.sklep.certum.pl/standard-code-signing.html

Lowering priority.