Using .Net Delayed Signing With Digicert Certificate

We have a pfx signing key from digicert that we use as delayed signing, but when we install it on a computer it won't run, unless we add an exclusion for that delayed signing key (sn.exe -Vr *,). This should be possible, right? Or am I missing something? I created a delayed signing key:

sn -p d:\DigCert.pfx DelayedSigning.snk

And then we use DelayedSigning.snk in C# .net assemblies as delayed signing:

And then after compiling and obfuscating, we use signtool to sign with the full key:

signtool.exe sign /f d:\DigCert.pfx /p ourPW /tr http://timestamp.digicert.com /td sha256 /fd sha256 /a outputPath\*.dll

And then like I said, if we try to run on a clean windows 10 OS it won't work unless we add the delayed signing exclusion (sn.exe -Vr *,). Any ideas?

Note: when I run sn -V on one of the assemblies, it says "XXXXX.dll is a delay-signed or test-signed assembly" - how come?

thanks for responses, yes I finally realized that strong-name signing and code signing are two different things. Solution is to create a separate signing code for strong signing: https://learn.microsoft.com/en-us/dotnet/standard/assembly/create-use-strong-named and then create a delayed signing key: https://learn.microsoft.com/en-us/dotnet/standard/assembly/delay-sign and use this in projects with delayed signing. Before shipping would sign it with sn.exe with the private strong-name signing key (info in last link). Then after it's strong name signed, sign with the digicert certificate with signtool.exe. https://www.digicert.com/kb/code-signing/signcode-signtool-command-line.htm