Windows: Sign files for Smart App Control

Discussed in https://github.com/pyinstaller/pyinstaller/discussions/6746

^{Originally posted by Evernow April 15, 2022}
Windows is introducing a new features in Windows 11 called Smart App Control later this year, it enforces code signing much more strictly than SmartScreen.

A major issue I encountered is that files Pyinstaller extracts for modules needed, such as pywintypes310.dll in my case may not be code signed, which would result in warnings such as these:

Is there a way to potentially sign these files the same way we can sign already made pyinstaller executables? A way is to do --onedir, however it is not practical to send end users a folder zipped and have to instruct them on how to launch the application.

Note: To currently test Smart App Control you need the latest W11 Insider ISO and then enable it in Windows Defender. You CANNOT simply update an older insider install or even less go from stable to insider, using Smart App Control requires a clean install of a build that comes with the feature.