In the Authenticode spec, there is an unauthenticatedAttrbutes structure, the contents of which does not affect the resulting signature.

Dropbox’s installer used it a while ago (maybe still, haven’t checked): https://news.ycombinator.com/item?id=8204454