Hi Friedrich,
Yes, the SafeNet app must be running for the EV dongle to work. It pops up a dialog for me to enter my password. I guess Sectigo did some deal.

Here is my signtool command, latest version as installed with Visual Studio, run from Powershell in administrator mode because of the location of the certificate.

signtool sign /debug /n "VSProwess Ltd" /tr http://timestamp.comodoca.com /td SHA256 /fd SHA256 "D:\vsSource\SetupBuilder\VSProwessX\VSProwessX_se tup_2X.X.exe".

FYI: it is important to check the timestamp was correctly applied. signtool appears to fail silently if the timeserver is not available and eventually you'll discover that your exe unexpectedly has a shelf life.

Thanks for looking at this.