Hi, based on our experience:
We use DigiCert reliable and widely accepted for AppSource submissions, no issues with validation.
We use a physical USB token works fine, though for CI/CD in Azure DevOps you'd need to handle the signing step manually or use a signing service since USB tokens don't integrate directly into pipelines.
We use a single cert across extensions under the same legal entity, no issues so far.
One thing to note beyond code signing don't forget the CAR (Code Analysis Report) is also required for AppSource submission. Make sure your code passes CAR validation before submitting, as that's a common blocker.
Hope this helps. Thanks
