For an Authenticode signed file to be verifiable by Windows after the original signing certificate has expired (typically 1-3 years after issue), the file also needs to have a cryptographically signed timestamp that Windows can verify.
There are a number of Authenticode timestamping services that will sign your binary for you for free (if they're online and working at the time).
It is not sufficient for the certificate associated with the timestamp signature to just chain back to one of the trusted root CAs in the Windows certificate store, or else your own Authenticode key could be used to sign the timestamp, making the whole exercise pointless (you could make a signature using an expired cert, then forge a timestamp from the past).
Is there an X.509 timestamping attribute that Windows checks in the cert before accepting the signature? If so, how can you get such a certificate?
Or is there a separate Authenticode timestamp trust hierarchy?