ClickOnce and Visual Studio Tools for Office (VSTO) signing uses the .NET Framework. This is because Sign CLI calls mage.exe -update, which ultimately uses .NET Framework to do the actual work.

We should update the package readme to explicitly mention this dependency.