Protect-GuestConfigurationPackage doesn't timestamp packages

Start at Protect-GuestConfigurationPackage and trace how package signing is configured and invoked. Determine how timestamping should be exposed through its parameters or tooling, then use Get-AuthenticodeSignature on a produced package to verify that TimeStamperCertificate is populated.

Details of the scenario you tried and the problem that is occurring

I recently set up signing of GC packages via Protect-GuestConfigurationPackage. The result is a package that is signed, but not timestamped, which will cause problems if the cert expires and we haven't redeployed using the updated cert.

Verbose logs showing the problem

PS C:\Users\ewadmn11\Downloads λ  Get-AuthenticodeSignature .\EwaCisScore.cat

    Directory: C:\Users\ewadmn11\Downloads

SignerCertificate                         Status                                    StatusMessage                             Path
-----------------                         ------                                    -------------                             ----
thumb  Valid                                     Signature verified.                       EwaCisScore.cat

PS C:\Users\ewadmn11\Downloads λ  Get-AuthenticodeSignature .\EwaCisScore.cat | fl

SignerCertificate      : [Subject]
                           CN=Enterprise Windows and Azure Administration, O=Indiana University, L=Bloomington, S=Indiana, C=US

                         [Issuer]
                           CN=Indiana University BL Issuing CA 2, OU=UITS, O=IU

                         [Serial Number]
                           4400097EC5BDC2D69681F636EA000100097EC5

                         [Not Before]
                           3/5/2026 12:55:22 PM

                         [Not After]
                           3/4/2028 12:55:22 PM

                         [Thumbprint]
                           thumb

TimeStamperCertificate :
Status                 : Valid
StatusMessage          : Signature verified.
Path                   : C:\Users\ewadmn11\Downloads\EwaCisScore.cat
SignatureType          : Authenticode
IsOSBinary             : False

Suggested solution to the issue

Add a parameter and tooling to support timestamping.

The operating system the target node is running

Windows Server 2025

Version and build of PowerShell the target node is running

7.5.4

Version of the module that was used

4.11.0