If we defined the SignTool, there are two flags in the [Files] section we can use: sign and signonce?
I can't really think of any case, why should I ever use signonce flag? When I recompile the script with the sign flag, nothing bad happens and the files stay signed. When do we really need to use that flag?
For example, you pack whole directory tree. Some of the files may be signed already and some not. And you may want to keep the original signature for the already signed files, and sign only those that are not signed yet.