What does Set-AuthenticodeSignature add to a PowerShell script, and why use a timestamp server?

Question

Accepted Answer

It appends a comment block with a Base64-encoded Authenticode signature (PKCS#7, including the certificate chain and a timestamp); the timestamp proves when the script was signed.
Set-AuthenticodeSignature -FilePath .\script.ps1 `
  -Certificate (Get-ChildItem Cert:\CurrentUser\My\ -CodeSigningCert) `
  -TimeStampServer http://timestamp.digicert.com

The command picks the user's code-signing certificate from the personal store, hashes the script, signs the hash with the private key, and appends to the end of the file:
# SIG # Begin signature block
# MIIb...  (many lines of Base64)
# SIG # End signature block

The block is a comment, so the script still runs normally; PowerShell parses it before execution to verify the signature.
Why a timestamp? The signing certificate expires (about a year). Without a timestamp, the signature becomes invalid on that date and every signed script stops running under AllSigned. The timestamp server, a separate trusted authority, countersigns the signature together with the current time. A verifier can then accept the signature as long as the certificate was valid at signing time, even years later.
Go deeper:

Microsoft Learn: Set-AuthenticodeSignature — parameters including -TimeStampServer.
 Wikipedia: Trusted timestamping — how a timestamp authority proves a signature existed at a point in time.