RDP security warnings in combination with AW RDS connector

As you may already know, Microsoft has started showing warning messages when users open RDP files:

Understanding security warnings when opening Remote Desktop (RDP) files | Microsoft Learn

As you may already know, Microsoft has started showing warning messages when users open RDP files: Understanding security warnings when opening Remote Desktop (RDP) files | Microsoft Learn
I have looked into this in detail, and the solution is a combination of digitally signing the RDP files together with a Group Policy in which you specify that the SHA1 thumbprint of the certificate is trusted:

GPS: Specify SHA1 thumbprints of certificates representing trusted .rdp publishers

In this way, the warnings are suppressed only for the RDP files that you distribute yourself, without reducing security for RDP files that are unknown or signed with an untrusted certificate.

This Microsoft change is separate from trusting certificates within an RDS deployment on Windows Server. However, it does appear that when using RDWeb, this certificate is used to sign the RDP files that users can click.
That is actually fine, because this ensures that the checkboxes users select for redirections are stored correctly. It then becomes possible to use the SHA1 thumbprint of that certificate in the GPO for trusted publishers.

What we are currently running into is that, at this customer, we are using a Satellite server with a Microsoft RDS app connector. This app connector dynamically creates the link to the RD App .RDP files, but these files are not signed.

As a result:

• The red warning appears every time

• The checkboxes cannot be saved

• There is no way to trust the SHA1 thumbprint of a certificate on the managed machines

It is possible to download the .RDP files (including those of RemoteApps) and sign them using the private key of the certificate, for example:

rdpsign.exe /sha256 $cert.Thumbprint "C:\Temp\RDS01-NES – RDAPP_Multivers.rdp"

However, in this way we cannot upload the .RDP file into Liquit as long as the link is tied to the Satellite server and connector.

My question is:

What is the best way to handle this so that users can save the redirections without disabling or reducing security?

Is there a way to mark RDP files as trusted from within AW?