Use the /d command line argument with the required program name when executing signtool to sign the msi.
It appears that the windows installer creates a temporary copy of the msi file and assigns it a generated name before running it. If you don’t use /d with signtool, you get to see the temporary filename which isn’t very useful for your users.