Comodo timestamp server defaults to SHA-1. To make sure timestamp signatures are SHA-256, add appropriate signtool.exe flag.