Since not all CA vendors support SHA-2 timestamp for the
SHA-2 digital signature you can still use a SHA-1 timestamp.
However, all applications signed with a SHA-2 signature and a
SHA-1 timestamp will be accepted until January 1st, 2017. After
this date, you must use a SHA-2 timestamp for the SHA-2 signature.