Sigining UWP-Apps with custom code sign certificate - certificate

Question

What exactly is the requirement to create a company internal App with Xamarin.Forms UWP? I can compile the *.appxbundle-Package but nobody can install it because of an certificate error. If I try to use our normal code signing certificate from StartSSL to sign the package, I got the following error:
The Manifest Designer could not import the certificate.
The certificate you selected is not valid for signing because it is
either expired or has another issue. For more information, see:
https://go.microsoft.com/fwlink/?LinkID=241478
The same certificate is used by our other desktop application with the signtool, so I guess the certificate is ok. Usage of the signtool for other .NET assemblies such as WPF projects:
"C:\Program Files (x86)\Windows Kits\10\bin\x86\signtool.exe" sign /f "..\..\..\..\..\Finaltec\Framework\Signing.pfx" /p ... /tr "http://timestamp.globalsign.com/scripts/timestamp.dll" "$(TargetPath)"
Are there any special requirements to sign a UWP app so anyone can install it? The used certificate is a Class 3 StartSSL Code Signing Certificate and it is valid until Junuary 2020. If I try to install the app with the generated test certificate from the Visual Studio, I got the message that the root certificate is not trusted and the installation process will be canceled. Even if I install the certificate manual before I got the same result error.
Code Signing Certificate informations:
Name: CVA Computer - Visualisierung und Animation GmbH
Address: Beckebohnen 2
Zip, City: 31618 Liebenau
State, Country: Niedersachsen, DE
Phone: [phone]
Email: info#cva.de
Expiry Date: 2017-04-14
Package.appxmanifest content:
<?xml version="1.0" encoding="utf-8"?>
<Package xmlns="http://schemas.microsoft.com/appx/manifest/foundation/windows10" xmlns:mp="http://schemas.microsoft.com/appx/2014/phone/manifest" xmlns:uap="http://schemas.microsoft.com/appx/manifest/uap/windows10" IgnorableNamespaces="uap mp">
<Identity Name="f736c883-f105-4d30-a719-4bf328872f5e" Publisher="CN=CVA Computer - Visualisierung und Animation GmbH" Version="1.0.1.0" />
<mp:PhoneIdentity PhoneProductId="f736c883-f105-4d30-a719-4bf328872f5e" PhonePublisherId="00000000-0000-0000-0000-000000000000" />
<Properties>
<DisplayName>CVA.COS_App</DisplayName>
<PublisherDisplayName>CVA Computer - Visualisierung und Animation GmbH</PublisherDisplayName>
<Logo>Assets\StoreLogo.png</Logo>
</Properties>
<Dependencies>
<TargetDeviceFamily Name="Windows.Universal" MinVersion="10.0.0.0" MaxVersionTested="10.0.0.0" />
</Dependencies>
<Resources>
<Resource Language="x-generate" />
</Resources>
<Applications>
<Application Id="App" Executable="$targetnametoken$.exe" EntryPoint="FPCL.WIndows.App">
<uap:VisualElements DisplayName="CVA.COS_App" Square150x150Logo="Assets\Square150x150Logo.png" Square44x44Logo="Assets\Square44x44Logo.png" Description="CVA.COS_App" BackgroundColor="#f4f4f4">
<uap:DefaultTile Wide310x150Logo="Assets\Wide310x150Logo.png">
</uap:DefaultTile>
<uap:SplashScreen Image="Assets\SplashScreen.png" />
<uap:InitialRotationPreference>
<uap:Rotation Preference="portrait" />
<uap:Rotation Preference="landscape" />
<uap:Rotation Preference="portraitFlipped" />
<uap:Rotation Preference="landscapeFlipped" />
</uap:InitialRotationPreference>
</uap:VisualElements>
</Application>
</Applications>
<Capabilities>
<Capability Name="internetClient" />
<Capability Name="privateNetworkClientServer" />
<DeviceCapability Name="webcam" />
</Capabilities>
</Package>

Answer 1

If I try to use our normal code signing certificate from StartSSL to sign the package, I got the following error
If we want to sing a UWP app, the code signing certificate is needed. The certificate you got from StartSSL is used for client authentication, you can check the Enhanced Key Usage field:
Available code signing cert:
The cert from StartSSL:
See also: What is special about a code signing certificate? and Intro to certificates
------Update 11/16/2016------
Please see the Validating Certificates section at https://go.microsoft.com/fwlink/?LinkID=241478
It looks like this certificate violates the sentence I bolded in:
Verifies the value of the Enhanced Key Usage property, which must
contain Code Signing and may also contain Lifetime Signing. Any
other EKUs are prohibited.
Their screenshot (below) shows the enhanced keys Codesignatur and Kernelmodus-Codesignatur.