When we looked earlier in the year, the only way to get non-signed desktop apps to run from metro was to either have a signed metro app call them or create a fudgy work-around by creating a dummy file/protocol type, assigning your desktop app as the default handler for that dummy type, and adding a file of the dummy type to metro. They also stated in january, with regards to the first solution, "we're moving away from allowing an application to start any other application". Not exactly free and open (or ideal), and not one for most users to do themselves.
