Steps to reproduce:

Build the appx package using the threshold_py3_staging branch, providing an authenticode certificate:

scons appx certFile=<path> certPassword=<password>

Actual behavior:

The package builds, but then signtool shows the following error:

SignTool Error: SignedCode::Sign returned error: 0x800700C1
        For more information, please see https://aka.ms/badexeformat

Expected behavior:

Signtool should succeedd.

more details

It seems this error exists due to the existance of python37.dll in the appx package. I.e. removing it allows the package to be signed.
Trying to sign python37.dll individually also causes this same signtool error.
For testing purposes, including python27.dll in the package instead, or in fact signing it individually with signtool, does not cause the error.
Extracting the file sections with 7zip, both files report some crc errors, but:
python37.dll seems to contain a certificate section (with a data error), where python27.dll does not contain a certificate section at all.
So, it looks like python37.dll is supposed to be signed, but might have a corrupt signature. Yet, get-authenticodesignature in Powershell does not report an invalid signature, rather it reports no signature at all.
I tried using ImageRemoveCertificate from imagehlp.dll to remove the certificate, but that seems to fail as well.