Since I always forget, here's the best way I've found to do it.
dotnet tool update -g OpenVsixSignTool
SET DOTNET_ROLL_FORWARD=LatestMajor
OpenVsixSignTool sign --sha1 08efc8cb4f0303dd4968a46f176cba010fae639c --timestamp http://time.certum.pl VisualStudio.Data.Sqlite.vsix