This particular dialog is the most scary one. There's a less-scary one if the application is signed but not countersigned. (Ie. it's only signed by you). To bypass it entirely, you indeed need a countersignature.
Windows contains a list of Trusted Root Certificate Authorities.(MMC.EXE > Add snap-in > Certificates > Computer Account). Some of those are intended for "Code Signing", which means those Certificate Authorities can counter-sign your signature. Verisign is in that list. If you're working on a corporate internet, the companies signature might/can be in there too.
Anyway, once you have a countersigned certificate, you indeed use signtool to sign both your app and its installer. Signing your own app is good practice, and helps a lot in Configuration Management. Signtool does have a GUI, but can also be used in CLI mode. The latter is useful when you want your build process to prompt for the key once and then build everything up to the installer. (Don't hardcode the password for your corporate certificate into your build process!).
But as I said earlier, you can also sign with a non-countersigned signature. This is quite useful for testing, as well as getting a hang of the whole process and doing automated builds.
