A recent post from Mike Sampson sheds even more light on permissions and ClickOnce. It would seem that Beta 2 will make this process a little easier. The process sounds more complex then it really is. Currently in order to raise the permissions for an assembly you have deploy "something", generally an MSI will do the trick, to all of the machines. With the new method, the cert has to be done once, then ClickOnce can request the permission change on behalf of the app. I feel this to be a much better model to follow. I hope the there aren't many changes between now and release, I hate having to go back and update chapters.