You'll note from above I've created two different types of certificates for two purposes. One that is used to create the publisher certificate and one that is used to verify the publisher. You'll normally get a certificate from a CA where they create one from one of those you already have in 'Trusted Root Certification Authorities" (this is the mechanism that makes it work). The full certification path is verified.