`New-SelfSignedCertificate` fails when logged in with publickey, works with password auth

Please answer the following

"OpenSSH for Windows" version
((Get-Item (Get-Command sshd).Source).VersionInfo.FileVersion)

7.7.2.2

PS C:\Users\IEUser> sshd --version                                                                                                                              
unknown option -- -                                                                                                                                             
OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5 

Server OperatingSystem
((Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows nt\CurrentVersion\" -Name ProductName).ProductName)

Windows 10 Enterprise Evaluation

PS C:\Users\IEUser> cmd /c ver                                                                                                                                  
                                                                                                                                                                
Microsoft Windows [Version 10.0.17763.1935] 

Client OperatingSystem
Ubuntu 20.04.1 LTS

What is failing

I'm trying to self-sign an Appx package. I'm following these steps. New-SelfSignedCertificate does not work when logging in with a SSH key:

me@ubuntu $ ssh -o PubkeyAuthentication=yes  msedge  
ieuser@MSEDGEWIN10 C:\Users\IEUser>powershell 
PS C:\Users\IEUser> New-SelfSignedCertificate -Type Custom -Subject "CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" -KeyUsage
 DigitalSignature -FriendlyName "Your friendly name goes here" -CertStoreLocation "Cert:\CurrentUser\My" -TextExtension @("2.5.29.37={text}1.3.6.1.5.5.7.3.3", "
2.5.29.19={text}")   
New-SelfSignedCertificate : CertEnroll::CX509Enrollment::_CreateRequest: Access denied. 0x80090010 (-2146893808 NTE_PERM)                                       
At line:1 char:1                                                                                                                                                
+ New-SelfSignedCertificate -Type Custom -Subject "CN=Microsoft Corpora ...                                                                                     
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~                                                                                         
    + CategoryInfo          : NotSpecified: (:) [New-SelfSignedCertificate], Exception                                                                          
    + FullyQualifiedErrorId : System.Exception,Microsoft.CertificateServices.Commands.NewSelfSignedCertificateCommand

It works if I log in with a password (same steps as above, expect ssh -o PubkeyAuthentication=no msedge).

Expected output
None, and certificate created successfully.

Actual output
New-SelfSignedCertificate : CertEnroll::CX509Enrollment::_CreateRequest: Access denied. 0x80090010 (-2146893808 NTE_PERM), as shown above.

I'm not sure if this is normal / expected behaviour. I did see https://github.com/PowerShell/Win32-OpenSSH/wiki/SSH-remote-sessions-on-Windows where it says

A remote session opened via key based authentication does not have associated user credentials

but I'm not 100% sure this is the issue. I found a post on Server Fault that might be relevant. I looked at the four pages under "OpenSSH in Windows" in the official docs but could not find any mention of such a limitation.

Start with the reported New-SelfSignedCertificate command and compare the same SSH session using public-key and password authentication. Read the linked SSH remote-session guidance about user credentials and the referenced certificate-store discussion. Done means determining whether the failure is an expected limitation or identifying the OpenSSH or documentation change needed to make the behavior clear or correct.