Based on comments here, Azure Trusted Signing with a personal certificate and their GitHub action worked.

This blog post below is great. It works through the process, including the truly weird/awful UX choices Azure makes. I archived it on wayback in case it ever disappears.

https://www.hendrik-erz.de/post/code-signing-with-azure-trus...