Unsupported/unexpected timestamp allowed

[dtivel]

Describe the bug
If I hack a timestamp service to return a timestamp using SHA-1, Sign CLI blindly allows it. In the case of NuGet package signing, inner PE file timestamping succeeds, but NuGet package signing fails, and yet the overall exit code is still success (0).

Sign CLI should verify that the returned timestamp used the requested algorithm.

Repro steps
Very complicated. Need to hack the project's test timestamping service to repro.

Expected behavior
Timestamps with unsupported or unexpected algorithms should be rejected. The overall exit code should be failure.

Actual behavior
PE timestamping succeeds. NuGet package signing fails. Overall exit code is success (0).

CC @clairernovotny