To complement the comment by @JozefIzso: The binary became trusted after about one month. While the further release become trusted after about 10 days only, third release did not become trusted for weeks again.
It does not look like a standard code signing certificate can be used nowadays. We gave up and went for EV certificate.
As you've figured out you can't transfer it, and you're stuck without using EV. Because you've got a new certificate, it took some time for your software to be verified as safe. What I think is happening now is that your signing certification is still seen as relatively new, and needs to build up reputation, but because the previous software release was ...
Nope. The entire certificate entry table is excluded from the Authenticode digest.
The intuition for this is that, in the case of multiple certificates, the length and other metadata in the certificate entry table would cause problems for consistent hashing.
MSDN offers similar reasoning (link):
When included in a certificate, the image digest must ...