ClickOnce/VSTO shows "Unknown Publisher" after Trusted/Artifact Signing certificate rotates (72h validity)

[BBJ-Artecomm]

Describe the bug

A VSTO add-in signed via sign code artifact-signing shows the publisher correctly verified (green checkmark) when the install prompt appears shortly after signing. After the certificate rotates (~72h validity), the same signed manifest shows "Unknown Publisher" on the install prompt, even though the manifest was signed with a valid timestamp at the time of signing.

Repro steps

1. Sign a .vsto/.manifest using sign code artifact-signing with --publisher-name and -t http://timestamp.acs.microsoft.com (see command below).
2. Launch the install by opening the .vsto file — the prompt shows the publisher correctly, no warning.
3. Wait ~72h for the Artifact Signing certificate to rotate/expire.
4. Open the same .vsto file again — the prompt now shows "Unknown Publisher" instead of the verified name.

Expected behavior

Per standard Authenticode/ClickOnce timestamp behavior, a valid timestamp should let the manifest continue to be trusted and display the correct publisher after the signing certificate's own validity period ends.

Actual behavior

The install prompt shows "Unknown Publisher" instead of the verified publisher name, despite the timestamp being present and valid.

Environment

• sign version:0.9.1-beta.26330.1+89c2a5d4a051014c243779d174bc3bb1fca62d7d
• Signing command:

sign code artifact-signing `
          "**/$(addinName).*" `
          "**/setup.exe" `
          --verbosity "Information" `
          --base-directory "$(Pipeline.Workspace)\VSTO" `
          --publisher-name "<publisherName>" `
          --description "$(description)" `
          --description-url "<url>" `
          --artifact-signing-endpoint <Endpoint> `
          --artifact-signing-account <CodeSigningAccountName> `
          --artifact-signing-certificate-profile <CertificateProfileName> `
          -t "http://timestamp.acs.microsoft.com"

Additional context

Before, we were using Azure Key Vault with an EV certificate and it was working as expected.