clarified instructions for certificates stored in hardware (#3276)

Author: edoardo-kolver

docs/create-packages/Sign-a-Package.md

@@ -29,6 +29,8 @@ You can use self-issued certificates for testing purposes. However, packages sig
 
 ## Export the certificate file
 
+* If your certificate is stored in a hardware token, you should not export the certificate. Instead, specify the SHA-2 family certificate fingerprints (thumbprint) by using the option `--certificate-fingerprint <SHA-2fingerprint>` (replacing `--certificate-path <PathToTheCertificate>`)
+
 * You can export an existing certificate to a binary DER format by using the Certificate Export Wizard.
 
   ![Certificate Export Wizard](../reference/media/CertificateExportWizard.png)