离线CI服务器上signtool带/csp/kc/f参数签名延迟过高问题

我正尝试在离线Windows 10 CI机器上集成基于DigiCert SafeNet令牌的代码签名功能。使用指定命令行签名可正常工作，但速度极慢：

D:\TEMP>signtool.exe sign /csp "eToken Base Cryptographic Provider" /k "[{{token_password}}]=priv_key_container_name" /f token_exported_cert.cer /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 /v /debug .\test.dll

The following certificates were considered:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
The following certificate was selected:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<< 此处延迟约1分20秒 <<<<<<<<<<<<<<<<<<

The following additional certificates will be attached:
    Issued to: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Issued by: DigiCert Trusted Root G4
    Expires:   Tue Apr 29 00:59:59 2036
    SHA1 hash: 7B0...

Done Adding Additional Store

<<<<<<<< 此处无密码提示或延迟，归功于 "[{{token_password}}]=priv_key_container_name"

Successfully signed: .\test.dll

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

注：该机器为气隙环境，但已允许访问时间戳服务器。在Windows资源管理器中查看证书“详细信息”时也会出现类似延迟，不确定问题源于signtool还是Windows系统。

使用另一命令签名时无延迟，但会弹出密码提示：

D:\TEMP>signtool.exe sign /sha1 633...c /tr http://timestamp.digicert.com /td SHA256 /fd SHA256 /v /debug .\test.dll

The following certificates were considered:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...c

After EKU filter, 1 certs were left.
After expiry filter, 1 certs were left.
After Hash filter, 1 certs were left.
After Private Key filter, 1 certs were left.
The following certificate was selected:
    Issued to: My Company (redacted)
    Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
    Expires:   Wed Apr 11 00:59:59 2xxx
    SHA1 hash: 633...c

Done Adding Additional Store

<<<<<<<<<<<<<<<<<<<<<<<< 此处弹出交互式密码提示（SafeNet客户端的Windows GUI）

Successfully signed: .\test.dll

Number of files successfully Signed: 1
Number of warnings: 0
Number of errors: 0

两种方式的明显区别是，延迟较高的命令会提示附加额外证书，但我不确定该细节的影响。

内容的提问来源于stack exchange，提问作者Martin Ba