signtool badly needs to be updated. The interface is very confusing and the documentation, while fairly complete, isn't very helpful.

That said, I just upgraded ours and didn't have much trouble switching to sha256. There is one quirk about the order of the arguments due to some limitation with the timestamping servers. The documentation loudly points this out though. If it helps, here's my exact command line:

    signtool.exe
        sign /v
        /n "Company, LLC"
        /ph /d "Description"
        /du "https://www.website.com"
        /tr "http://timestamp.comodoca.com"
        /td sha256 # /td must come after /tr
        /fd sha256
        executable.exe

Not being able to automate these EV hardware tokens because of the password is a pain that I'm already annoyed by though.