Signing a Clickonce application with a key vault does not work because RSAKeyVault does not have an implementation for ExportParameters that retrieves the certificate from the key vault. We could remove calls to ExportParameters in our code but that would not resolve methods where we pass in the RSA object and that code calls that method. One example where that is happening is inside the SignedXml class. To solve this we would need to return an RSA class that has a similar way of solving this problem like we do inside the RSATrustedSigning class.