Signing ClickOnce with password protected PFX certificate

This time I had to find out how to make the TFS build step use a PFX certificate file to sign the ClickOnce manifest. It turned out to be quite a tricky task though.