diff --git a/PowerShellBuild/build.properties.ps1 b/PowerShellBuild/build.properties.ps1
index acd53cf..f8d4d6b 100644
--- a/PowerShellBuild/build.properties.ps1
+++ b/PowerShellBuild/build.properties.ps1
@@ -207,7 +207,18 @@ $moduleVersion = (Import-PowerShellDataFile -Path $env:BHPSModuleManifest).Modul
         # rather than a check layered on afterwards.
         SkipCertificateValidation = $false
 
-        # RFC 3161 timestamp server URI embedded in Authenticode signatures.
+        # Timestamp server URI embedded in Authenticode signatures, so a signature
+        # stays valid after the signing certificate expires.
+        #
+        # This is passed to Set-AuthenticodeSignature -TimestampServer, which uses the
+        # legacy Authenticode timestamp protocol -- the timestamp lands in the signature
+        # as a PKCS#9 counter-signature (1.2.840.113549.1.9.6), not as an RFC 3161 token
+        # (1.3.6.1.4.1.311.3.3.1). That is signtool's /t rather than /tr. Verified on both
+        # PowerShell 7 and Windows PowerShell 5.1; see psake/PowerShellBuild#196.
+        #
+        # It matters when choosing a different provider: several publish separate
+        # endpoints for the two protocols, and an RFC 3161 only endpoint will not answer
+        # this request. The default below serves both.
         TimestampServer           = 'http://timestamp.digicert.com'
 
         # Authenticode hash algorithm. Valid values: SHA256, SHA384, SHA512, SHA1.
diff --git a/README.md b/README.md
index a66b930..3dfbf51 100644
--- a/README.md
+++ b/README.md
@@ -139,7 +139,7 @@ match your environment.
 | $PSBPreference.Sign.PfxFilePassword                         | `$null`                                     | Password for the PFX/P12 file as a `SecureString`. Used by the `PfxFile` certificate source.                                                                                 |
 | $PSBPreference.Sign.Certificate                             | `$null`                                     | A pre-resolved `X509Certificate2` object to sign with. When set, `CertificateSource` is ignored, which suits Azure Key Vault, an HSM, or another custom provider.            |
 | $PSBPreference.Sign.SkipCertificateValidation               | `$false`                                    | Relax certificate validity checking. Skips every check for `EnvVar` and `PfxFile`, private key included. See [Code signing](#code-signing).                                  |
-| $PSBPreference.Sign.TimestampServer                         | `http://timestamp.digicert.com`             | RFC 3161 timestamp server URI embedded in the signature so that it stays valid after the certificate expires.                                                                |
+| $PSBPreference.Sign.TimestampServer                         | `http://timestamp.digicert.com`             | Timestamp server URI embedded in the signature so it stays valid after the certificate expires. Legacy Authenticode protocol, not RFC 3161.                                  |
 | $PSBPreference.Sign.HashAlgorithm                           | `SHA256`                                    | Authenticode hash algorithm. Valid values are `SHA256`, `SHA384`, `SHA512`, and `SHA1`. `SHA1` is deprecated.                                                                |
 | $PSBPreference.Sign.FilesToSign                             | `@('*.psd1', '*.psm1', '*.ps1')`            | Glob patterns of file names to sign, searched recursively under the module output directory.                                                                                 |
 | $PSBPreference.Sign.Catalog.Enabled                         | `$false`                                    | Enable/disable creation and signing of a Windows catalog (`.cat`) file. Also requires `$PSBPreference.Sign.Enabled` to be `$true`.                                           |