I am developing a secured embedded application which receives a code , signed using RSA-2048 and verifies its signature before activating it using a pre-programmed public key. I want to use code-signing certification in order to verify the entity which created and signed this code. I did a research online and I didn't found any clear flow on the usage of such certificates , I have the following questions remained without a clear answer.
1.Suppose a CA will issue such a certificate for the code , does the public key which is signing the certificate will be attached to it ? if so , what will prevent an attacker from altering this certificate and signing it with his own pair of keys ? and if not , where the public key to authenticate the certificate will come from ?
2.Do I have to parse the certificate inside the embedded application ?
3.Where can I get an example of such a certificate ?