Also notice my old and expired Sectigo issued certificate doesn't have key, as i didn't imported it, so can't be used for signing automatically.
while my Kas issued by Kas is root one and does have key, but it is not for code signing, it is for different usage, and IIS will automatically use/offer it for
localhost on my device.