Since I always forget, here's the best way I've found to do it.
dotnet tool update -g OpenVsixSignTool
SET DOTNET_ROLL_FORWARD=LatestMajor
OpenVsixSignTool sign --sha1 f4d452b501c18a23e8eed7fa67c7510fa0f9bccb --timestamp http://time.certum.pl VisualStudio.Data.Sqlite.vsix