Preliminary I can see there is no such a standard for softwares from different companies. Standards from each of the software vendors could exist, but not in publicly available documentations. Probably you need to sign-up to a code-signing package from a vendor to exercise the process to find out more. Even though that probably will not be straight and simple to find out the signing details because most of the packages poorly document the internals than just showing you the steps.
The signing key most likely will be RSA, as @BlueWizard pointed out in the comment.
The signed certificate, should contain the subject public key with other directives or meta-information. The subject public key should be verified by the signer public key.
Let's use a subject as an example who produces software. A sequence of steps could be:
-  The subject submits the subject public key to the authority signer.
-  The authority signer put the subject public key with some meta-information together, and encrypt it with the signer private key. This produces a certificate. The certificate is returned to the subject.
-  The subject puts the hash of a to-be-signed software image with the certificate into an unsigned or to-be-signed package.
-  The subject encrypts the unsigned package with its own private key.
-  The subject publishes the signed package and its signing public key.
-  The receiver decrypts the package with the package signing public key. Then decrypts the certificate with the authority public key. If the decrypted certificate message contains the obviously verifiable meta information the validation is successful. The meta-information put in by  and verified here probably will contain the name of the signing authority and the name of the subject, when the certificate was signed, and when its validity shall expire, what it should be used for, etc.
An exception to the above is that, if the package signing key used at  is different from the certified key, the subject needs to encrypt the signing public key using the certified private key. This creates an intermediate certificate.
The meta-information involved in  and  should be specified by the signing and validation standard.