Interesting, what command did you use? This works for us without any issues:
signtool sign /a /fd SHA256 /tr "http://timestamp.globalsign.com/?signature=sha2" /td SHA256 <exefile>
signtool sign /a /fd SHA256 /tr "http://timestamp.globalsign.com/?signature=sha2" /td SHA256 <exefile>
And maybe I'm spoiled, but could it not require four switches of a "don't do useless thing" kind? It's as if `copy` required /ones /zeros switches to be explicit you don't want it to omit these bits.