From this line:

<_DesktopMSBuildRequired Condition="'$(_DryRun)' != 'true' and '$(MSBuildRuntimeType)' == 'Core'  and '$(OS)' == 'Windows_NT'">true</_DesktopMSBuildRequired>

We are currently using desktop msbuild when running on Windows with .NET core. After we have validated that using .NET Core MSBuild on other OSes does not negatively impact the usage of SignTool, we should change the default on windows to be what is currently executing. That is, if we're already on core, we shouldn't require desktop msbuild.