Note: signtool cannot authenticode-sign PDFs in a way Adobe Reader recognizes as a PDF digital signature. It can attach an Authenticode signature to the file, but this is not a standards-compliant PDF signature. This is acceptable only if you explicitly need Authenticode (e.g., integrity checks), not Adobe-style signing.
Download and install latest stable Windows SDK for your windows version (usually Windows 11 x64) and . This includes signtool.exe.
https://learn.microsoft.com/en-us/windows/apps/windows-sdk/