That’s how it works on Windows already. You buy a cert from a third party vendor so your setup file can pass Windows security checks and doesn’t show a big warning to the user when they open the setup file.