Why does Microsoft's signtool verify command return an error when verifying a signed program?

SignTool Error: A certificate chain processed, 
but terminated in a rootcertificate which is not trusted by the trust provider.
Number of errors: 1

This error occurs because you purchased a standard code signing certificate rather than an EV code signing certificate. By default, Microsoft SignTool uses driver signing verification mode for the verify command (which requires an EV certificate), so the direct verify operation fails. You need to add the /pa parameter.

The relevant Microsoft documentation explains this here: Microsoft related documentation.

Command example: signtool verify /v /pa datestrl.exe