You don’t need to code sign on the fly in order to append “config” data to an authenticode executable.

I’ve never done it myself but there was a posting here about 8 years ago about how Dropbox distributed their installer and I took a quick look at it: https://news.ycombinator.com/item?id=8204454