Unsupported/unexpected timestamp allowed

[dtivel]

Describe the bug If I hack a timestamp service to return a timestamp using SHA-1, Sign CLI blindly allows it. In the case of NuGet package signing, inner PE file timestamping succeeds, but NuGet package signing fails, and yet the overall exit code is still success (0).

Sign CLI should verify that the returned timestamp used the requested algorithm.

Repro steps Very complicated. Need to hack the project's test timestamping service to repro.

Expected behavior Timestamps with unsupported or unexpected algorithms should be rejected. The overall exit code should be failure.

Actual behavior PE timestamping succeeds. NuGet package signing fails. Overall exit code is success (0).

CC @clairernovotny