For the exceptions, you can sign your own using internal CA.
And keep signing it with every release. No thanks.
And keep signing it with every release. No thanks.