A while ago Keith an me wrote an article about security consideration for ClickOnce deployments. It is now up on MSDN.
The text was based on Beta 1/2 and is not 100% accurate anymore. While preparing a ClickOnce talk for DevWeek, I noticed some interesting changes and gotchas you should be aware of when thinking about using that technology. I will write these up in the next days…
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dv_vstechart/html/ClickOnceSec.asp