Paying for Azure Trusted Signing, yet installers get blocked on Windows

For a few weeks now, many Windows apps signed with Azure Trusted Signing (a paid service) have started showing a "Windows protected your PC" warning, prompting users to click "more info" to proceed. It started badly, with new builds affected by SmartScreen. At least the releases made a few days before worked. Then it got worse, and now it seems all installers ever signed with ATS are affected. And we switched from 3rd party CA to Azure to avoid exactly this kind of problem. Needless to say, the reputation of many vendors is negatively affected.