You can automate code signing using Microsoft azure key vault. I did it last month, no need for a dongle nor a pin number
As far as I can tell, the video is the only public information on the non-GA service: https://youtu.be/Wi-4WdpKm5E?t=529
I’m ready for bipartisan gutting of big tech.