If you must pack signed binaries in Azure DevOps, you need to

• Output the binaries for signing to a folder, say ‘forSigning’.
• Pack the signed binaries without rebuilding.
• Sign the NuGet package again.

My problem was figuring out how to specify the input and output folders to DotNetPack. It turned out, you can specify the input path with /p:OutputPath and set the output using --output.

Example:

- task: DotNetCoreCLI@2
            displayName: 'DotNetCore Pack'
            inputs: 
              command: 'custom'
              custom: 'pack'
              arguments: '--no-build $(Build.SourcesDirectory)/MyProject.csproj --verbosity normal --output $(Build.SourcesDirectory)\Out  /p:OutputPath=$(Build.SourcesDirectory)\forSigning'