After spending all day struggling with this I finally managed to code sign from the command line with my new Sectigo EV dongle. What eventually worked for me was to install the certificate while logged in as administrator and under the local machine store: Trusted Packaged App Installation Authorities. But so far I've been unable to make hardware code signing work from within SetupBuilder. I really miss the convenience of this so does anyone happen to have a magic incantation please?