[bagels]

Okay, you need an EV certificate (required to be on a hardware token), and next you need to integrate it in to a CICD pipeline.

[likeabatterycar]

Signtool interfaces with any kind of certificate including on smartcard.

https://www.mgtek.com/smartcard

For automating pin entry

[bagels]

I was able to bypass the 2fa using the right signtool incantations