Tweak.

ishelp/isetup.xml

@@ -4945,7 +4945,7 @@ SignTool=byparam signtool.exe sign /a /n $qMy Common Name$q /t http://timestamp.
 <pre>
 [Setup]
 SignTool=mycustom sign /a /n $qMy Common Name$q /fd sha1 /t http://timestamp.comodoca.com/authenticode /d $qMy Program$q $f
-;the /as parameter in the following SignTool requires a recent signtool.exe version
+;the /as parameter in the following SignTool requires a recent signtool.exe version and a SHA256 (SHA-2) certificate
 SignTool=mycustom sign /a /n $qMy Common Name$q /as /fd sha256 /td sha256 /tr http://timestamp.comodoca.com/rfc3161 /d $qMy Program$q $f
 </pre>
 <p>Note: for security reasons you should give a unique name to any Sign Tool set to <tt>$p</tt>, and not use a <tt>byparam</tt> name copied from this example. Consider what happens if you #include a third-party file that says:</p>

whatsnew.htm

@@ -28,7 +28,7 @@ For conditions of distribution and use, see <a href="http://www.jrsoftware.org/f
 
 <p><a name="5.5.8"></a><span class="ver">5.5.8 </span><span class="date">(2016-01-13)</span></p>
 <ul>
-<li>The [Setup] section may now list multiple <tt>SignTool</tt> directives which will be executed in order of appearance. This can be used to dual sign (SHA1 &amp; SHA256) Setup and Uninstall. This requires a recent signtool.exe version. Inno Setup's own installer is now also dual signed. See the help file for a <a href="http://www.jrsoftware.org/ishelp/index.php?topic=setup_signtool">dual sign example</a>. <b>Without dual signing Windows will no longer trust any of your new installers if they are downloaded</b>. See <a href="http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx">http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx</a> for more information.</li>
+<li>The [Setup] section may now list multiple <tt>SignTool</tt> directives which will be executed in order of appearance. This can be used to dual sign (SHA1 &amp; SHA256) Setup and Uninstall. This requires a recent signtool.exe version and a SHA256 (SHA-2) certificate. Inno Setup's own installer is now also dual signed. See the help file for a <a href="http://www.jrsoftware.org/ishelp/index.php?topic=setup_signtool">dual sign example</a>. <b>Without dual signing Windows will no longer trust any of your new installers if they are downloaded</b>. See <a href="http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx">http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx</a> for more information.</li>
 <li>The console-mode compiler (ISCC) now accepts multiple /S command line parameters (to specify a Sign Tool) instead of ignoring all but the last.</li>
 </ul>