Ask HN: How to code sign Windows binaries now?

I'm trying to get a new signing certificate for Beekeeper Studio. I build using Github Actions.

It looks like some industry group changed the rules, now I can only get a certificate on a physical USB drive.

Is that right? Is anyone else here doing this entirely online somehow?