Is there a target I can hook in my Target's AfterTargets to always be the last target that runs?

[rkeithhill-keysight]

I'm trying to come up with a target that Authenticode signs a published binary. I have hooked AfterTargets="Publish" and that seems to work for just about everything except when the user builds with PublishAot set to true. My target signs the file in the publish dir except that the Microsoft.NETCore.Native.Publish.targets then copies the "unsigned" binary from the native directory over the one that was just signed in the publish dir. 🤦‍♂️