Enable signing validation with exclusions

eng/SignCheckExclusionsFile.txt

@@ -0,0 +1,12 @@
+;; Exclusions for SignCheck. Corresponds to info in Signing.props.
+;; Format: https://github.com/dotnet/arcade/blob/397316e195639450b6c76bfeb9823b40bee72d6d/src/SignCheck/Microsoft.SignCheck/Verification/Exclusion.cs#L23-L35
+;;
+;; This issue tracks a way to implement exclusions via Signing.props and avoid this extra file: https://github.com/dotnet/arcade/issues/2888
+
+;; The apphost and comhost are template files, modified by the SDK to produce the executable for FDE
+;; and FDD apps. If they are signed, the file that the SDK produces has an invalid signature and
+;; can't be signed again. More info at https://github.com/dotnet/core-setup/pull/7549.
+*apphost.exe;;Template, https://github.com/dotnet/core-setup/pull/7549
+*comhost.dll;;Template, https://github.com/dotnet/core-setup/pull/7549
+*apphosttemplateapphostexe.exe;;Template, https://github.com/dotnet/core-setup/pull/7549
+*comhosttemplatecomhostdll.dll;;Template, https://github.com/dotnet/core-setup/pull/7549

eng/stages/publish.yml

@@ -24,8 +24,6 @@ stages:
       - PublishBlob_${{ dependency.dependsOn }}
     # Symbol validation is not ready yet. https://github.com/dotnet/arcade/issues/2871
     enableSymbolValidation: false
-    # Doesn't work yet, not fully configured. https://github.com/dotnet/core-setup/issues/5254
-    enableSigningValidation: false
     # SourceLink validation doesn't work in dev builds: tries to pull from GitHub. https://github.com/dotnet/arcade/issues/3604
     enableSourceLinkValidation: false
     # Allow symbol publish to emit expected warnings without failing the build. Include single