After serverl days of study and testing I am still not able to digitall sign a VSI package.
Serval threads in the Internet tell about buggy makezipexe versions and so on.
After trying serval methods I was aber to change the vsi back to .zip as an extenstion.
After that I used mekezipexe.exe to convert the file, after that I was able to sign the ".exe" using signtool.exe which displayed a success messaged after signing.
After renaming the file back to vsi and double clicking a memory exception pops up.
Is there any clear way to sign a package.